High memory usage - Error: cpaq_cbuf_alloc_rcv_buf_info

[intaq]

Hello guys:

Checking a high memory usage problem, "apparently", I have encountered these errors in /var/logs/messages and in the cpview.

Jun 25 23:56:27 2024 fwchk kernel: [fw4_0];cpaq_cbuf_alloc_rcv_buf_info: buf_id=14550786 unable to allocate buffer sz=44544
Jun 25 23:56:27 2024 fwchk kernel: [fw4_0];cphwd_cpview_cb: data is NULL sz=44528
Jun 25 23:56:27 2024 fwchk kernel: [fw4_0];cpaq_cbuf_send_buffer: NULL user buffer (requested size:44528)
Jun 25 23:56:27 2024 fwchk kernel: [fw4_0];cpaq_sxl_send_cpview: Could not create buffer size 44528
Jun 25 23:58:27 2024 fwchk kernel: [fw4_0];cpaq_cbuf_alloc_rcv_buf_info: buf_id=14550873 unable to allocate buffer sz=44544
Jun 25 23:58:27 2024 fwchk kernel: [fw4_0];cphwd_cpview_cb: data is NULL sz=44528
Jun 25 23:58:27 2024 fwchk kernel: [fw4_0];cpaq_cbuf_send_buffer: NULL user buffer (requested size:44528)
Jun 25 23:58:27 2024 fwchk kernel: [fw4_0];cpaq_sxl_send_cpview: Could not create buffer size 44528

As I said, this comes from high memory usage but I don't know if it has anything to do with it or is related:

Do you know if it could be related or have you seen these errors before?

Thanks in advance!!

[G_W_Albrecht]

Looks like https://support.checkpoint.com/results/sk/sk162776

[intaq]

It could be, but we are in R81.10 take 110.

[Chris_Atkinson]

What type/model of gateway is this and which version/jhf?

[intaq]

5800 R81.10 JHF 110

[emmap · Accepted solution]

There are some memory leak fixes in later JHF takes, the best advice as a first step would be to update to the latest recommended take. If the messages continue then it's time for a TAC case.

[Chris_Atkinson]

Note also that a 5800 whilst being an older appliance can have a greater memory population than 8GB which is the base/minimum spec.

[PhoneBoy]

Looks related to me.
The fact you're dipping into swap is not good.
Have you opened a TAC case?

[intaq]

No, I haven't yet opened a case. Have you seen it before?

[PhoneBoy]

Not these specific messages.
The errors refer to not being able to allocate a buffer, which requires memory.
That suggests they're related (more as a symptom, not necessarily the cause).

[intaq]

Hello:

Problem solved after upgrading to the latest recommended version R81.10 JHF 150. No errors have been reproduced again and memory usage has gone down.

Thanks for the help!

[Zolo]

Hi all,

We have the same problem, it is clearly related to the Nessus scan.

When a Nessus scan is performed through the firewall, in addition to the error message above, the memory usage increases and does not decrease even after the scan is finished.
Version: R81.20 Jumbo HFA Take 76 (latest recommended)

There is an open TAC case, but no solution yet.

Any suggestion?

Thanks,

Zolo

[Lesley]

Hi Zolo,

You have any news regarding this TAC case?

Thanks,

Lesley