CPU goes 100% - Process temain ted

[sebasnqn]

Hello mates! How are you all?

   We're having issues in our FW; perhaps one of you had this problem before.

FW is an open server, Version 81.10 with JHF T130; it has hyperthreading enabled  and is running as proxy.

Every working day seen past few weeks, the CPU  goes to 100% for several minutes. We checked the process and the temain ted seems to be taking all the stars.

There are a few elephant connections but can't be accelerated because of FW been used as proxy I think.

I've checked the affinity for temain, and seems to be attached to all the CPU available.

But, if I do "tecli show affinity" the result is 

Command: root->show->affinity
error: unable to retrieve process affinity

If I check the management to see logs of the IPS blade, there is nothing there, probably because FW its suffering on 100% load.

I've no idea where else to look or what to do here; help would be really appreciate.

Thanks in advanced!

[the_rock]

Does cprestart or reboot help?

Andy

[sebasnqn]

Hello Andy,

     Thanks for replying.

We did not restart the FW; I could try it tomorrow. After those 20 to 40 minutes of 100% load, goes like "normally".

[the_rock]

I know one client who had this problem and went away after they upgraded to R81.20. I cant recall now what jumbo they installed, but this was few months back, probably April or May.

Andy

[sebasnqn]

Ok, it's an option!

      We've thought that and it's scheduled to do this weekend; we'll see if it helps!

Thanks!

[the_rock]

Im fairly positive it WILL help!

Andy

[sebasnqn]

Hello Andy,

   We've upgraded to 81.20 last JHF but the problem still there. Also discover a new ones but that another thread.

I've also checked the hits on urlf with this command fw tab -t urlf_cache_tbl -s and we'e 7335 on #vals conlumns. 

[AkosBakos]

Hi @sebasnqn 

If we talk about "Elephant Flows"  consider to user SecureXL Fast Accelerator" 

https://support.checkpoint.com/results/sk/sk156672

It would help a lot.

Akos

[sebasnqn]

Hi Sir,

  Thanks for replying.

We've a few rules activated, but no hits on them. I think related to the proxy usage of the firewall.

Thanks though!

[the_rock]

That also makes sense to me.

Andy

[PhoneBoy]

ted is "Threat Emulation" not IPS.

Traffic cannot be accelerated with SecureXL when the gateway used as an explicit proxy.