*.ds Files in C:\ProgramData\CheckPoint\DBStore taking too much space

[CP-Shark]

Hello folks,

on a few servers in our environment, we have the issue that the main partition C: is running out of space. We could identify that the reason for that behavior are multiple *.ds files under C:\ProgramData\CheckPoint\DBStore\.

We are running endpoint version E87.31 on all our server with the following blades installed:

There are *.ds files stored from today, but some are more than 8 month old. Where are these files coming from, and how can I delete these file, and why is it happening?

Looking forward to more information and hopefully a solution for that.

Cheers,
Olli

[Chris_Atkinson]

Are you using the server optimization exceptions?

Refer also: sk178706, sk179791

[CP-Shark]

Not on this server and it seems that the SKs are not the right one to my issue.

C:\ProgramData\Checkpoint\DBStore\AmsiScripts\ is fine with just 60 files included (~84KB). The *.ds files are close to 40GB in total.

And related to the 2nd SK it´s not an Exchange server.

[Chris_Atkinson]

Noted. I can see other cases where TAC have worked with customers to clear the space and are monitoring the issue after upgrading to a more recent Endpoint version.

[CP-Shark]

Ok. Solution would be upgrading to a higher version of End Point agent?

[Chris_Atkinson]

It's unclear from the limited sample set I reviewed but TAC would be able to confirm.

In your own case what is the distribution of the files and their sizes, maybe clearing the old files is sufficient but will still need TAC assistance unless you are familiar with temporarily disabling the self protection.

[CP-Shark]

Could you provide more information to "temporarily disabling the self protection"?

[Chris_Atkinson]

The process is available via TAC. 

By default certain product related paths/files are protected from deletion/removal.

[G_W_Albrecht]

1. Use the "PassDialog.exe" file you received from CP TAC
2. Unzip it.
3. Run PassDialog.exe with administrator privileges.
4. Enter Endpoint Security client uninstall password

[Denis_Davila]

Hi @CP-Shark,

I am having the same problem with an Endpoint client in version E87.60, since a few days ago it began to increase in *.ds files without stopping.

Did you manage to find the error? Did you have any solution?

Regards

[Gro_Tea]

Same here with 87.62

50k + files of varying size since 4th of April all ending with .ds. Summed up its about 40 GB +

[Denis_Davila]

Hello @Gro_Tea @CP-Shark ,

I managed to solve it, what I did was perform an update to version E88.00, the files seem to continue being created for a few minutes.

After about three hours the *.ds files disappeared automatically.

PS: I did Repair Client, Change Policy Rules before this and nothing worked.

I hope it helps you.

Regards

[Denis_Davila · Accepted solution]

I managed to solve it, what I did was perform an update to version E88.00, the files seem to continue being created for a few minutes.

After about three hours the *.ds files disappeared automatically.

PS: I did Repair Client, Change Policy Rules before this and nothing worked.

[asafebelo]

Hello, everyone

Someone with this issue in "newer versions" ? I found this issue in a 88.62 version.

[lluner]

@asafebelo 

Install the recommended version E88.72

[Chris_Butler]

I have a similar problem on a Server 2019 Hyper-V guest that had about 40GB of *.ds files 

It was running 85.10 

I am currently upgrading in-place to 88.72.

I am hoping the new client will be smart enough to clean up the old files

[CP-Shark]

Should fix it, yes. 
After migration to E88.xx this issue did not occure any more

[Chris_Butler]

Took some doing, could not upgrade from 85.10 to 88.72 in place, the batch deployment upgrade pushed from the management server just kept looping. Eventually got it installed manually

Sure enough I now have 48 GB free on that server.

Thanks for the reply!! 🙂

[fabiowilliam]

@lluner 

I'm having this problem even in 88.72. Do you know of any way to clean this file manually?

[lluner]

I updated to version 89.10. I believe you can create a push operation "remote command" in PowerShell to delete it.

[fabiowilliam]

The problem with creating a remote command is that you either need the CheckPoint execution signature or you need to disable self-protection, which would require restarting the server, and we can't do that because it's a file server.
Can you tell me if the upgrade from 88.72 to 89.10 requires a reboot?

[lluner]

@fabiowilliam 

The machine will not reboot.

[Chris_Butler]

I am in a similar boat..  

88.72 and a Hyper-V Server 2019 VM serving as our second Domain Controller suddenly had ZERO bytes free on it's C: drive. I had to expand the virtual disk to be able to do anything at all.  

Then found that the C:\ProgramData\CheckPoint\DBStore folder is 43.8 GB..   

Not only that, but i have been stuck in a quandary with the Security Management and Endpoint management TAC departments because I am having an issue where endpoint clients connecting to the management server is broken, and you can't use Smart Endpoint or the Endpoint web management UI,   unless you break the ability to use the GAIA portal / Smartview web view / any new tabs in SmartConsole | Logs 

This is getting old.  

I have tickets open with both groups and I am going to be working on yet another remote session tomorrow, this time with Endpoint TAC..   

The clients have been able to get their signature updates directly from threatcloud but they have not been able to connect to the management server for the better part of a week.

I am thinking that this might be local Endpoint Client logging queueing up on the DC and not being able to be offloaded up to the management server?  Who knows..

C.

[fabiowilliam]

Hi, Chris,

Our client has upgraded to 89.10, and it seems there have been some improvements.

During a call with TAC, they asked me to disable a security feature to resolve the issue, which I flatly refused to do, so they only disabled the scanning of SMB package downloads. However, I don’t see the point in disabling a security feature instead of resolving the problem.

Upon analyzing the situation without TAC, I realized that clients on this server are flooding it with honeypots created by the endpoints themselves, which is why these files keep growing significantly.

As for the calls with TAC, they are indeed very time-consuming and exhausting. I raised concerns about the security implications of disabling the feature and creating a vulnerability, but they haven’t responded to me in nearly a week.

[JayM1]

Hi All,

Running checkpoint 89.10.0370

ActivityCache.db-wal file 25GB file sizes on vm client using up disk space still.

Anyone know how to clear the files automatically?