Management dump files

[Premysl_Vresky]

In the C: \ Windows \ Internet Logs folder, dump Check Point files are stored.
For example:
EFRService_2nd_2018_01_31_21_08_37_small.dmp
CP_EFR_Crash_860045016_1515599330.dmp

On one computer, I found 7 GB total logs.

Since I have over 1500+ endpoint installs, I do not even know how many computers these dmp files are and how much space they occupy. I need to help with the third party tool for analysis and removal.
Idea:
Put some size limit on this folder, or direct these files to another folder and put there a similar mode as the folder c: \ sendblastbackup .. to delete old files.
Just introduce some management of these files
I have a ticket based on this issue, I write it here to help other administrators if they do not know about it.

[XBensemhoun]

Hi, did you try to understand why such dump logs were generated ? Was there generated frequently ? During a specific period of the day/week/month  ?

Do you have the same version deployed on every workstation ? If so : what version (maybe a known issue fixed in later builds) ?

For the deletion of the logs : dis you deploy the package through tools such as Altiris, SCCM, ... ? Because you should include in the package installation process the deletion of such files (and just before : generat a report in order to understand if this issue is at large or for specific computers).

[Premysl_Vresky]

The principle of this idea is not to solve individual cases, these files are old, on computers we perform regular update of clients.
I'm afraid that the storage of these files is not limited. I'm just starting to analyze the situation, I find that damp files are on hundreds of computers. On laptops we usually have a 128GB SSD HDD and then there is a problem if the dump files occupy, for example, 15GB.
It's a native system solution via Check Point. I could imagine a limit of 2 GB, for example, and gradually remove old files.
I assume that these files did not occur during deployment but during normal operation.

[Amanda_90]

Hi, Guys!

I have the same problem on an endpoint, it is taking up too much space in the ProgramData\CheckPoint\EndPoint Security\Threat Emulation\ folder

They are files with the same .DMP extension, I would like to know if I can delete them and how can I do it?

[toviab]

Hi @Amanda_90 , 
If these files are new it can indicate a problem with the ThreatEmulation service and we would need to investigate why the service is creating these dump files.
If it is old files from older version then these can be deleted.
You can contact TAC to assist in removing these files as they are protected and you will need to remove the protection prior to deleting them.
Regarding the main issue, we will discuss this issue and see how we can address the issue by setting a limit to these files.

[PhoneBoy]

It seems like you should be engaging with the Check Point TAC about this.

Contact Support | Check Point Software 

[Premysl_Vresky]

Yes, I work together. I wrote the information here because I think it might be of interest to the CheckMate community. It has not occurred to me for several months that there is so much data on computers.