- Products
- Learn
- Local User Groups
- Partners
- More
AI Security Masters E7:
How CPR Broke ChatGPT's Isolation and What It Means for You
Blueprint Architecture for Securing
The AI Factory & AI Data Center
Call For Papers
Your Expertise. Our Stage
Good, Better, Best:
Prioritizing Defenses Against Credential Abuse
Ink Dragon: A Major Nation-State Campaign
Watch HereCheckMates Go:
CheckMates Fest
Hello,
is it normal that cpcgroup.elg is flooded the whole day? We get 30 new lines every second. Using R81.20 T76/96/98
cpcgroup 7094 4143736640]@fw-inet2024-01[25 Mar 8:36:02] cpcgroup_add_pid_to_cgroup_cb: pid is 73567
[cpcgroup 7094 4143736640]@fw-inet2024-01[25 Mar 8:36:02] cpcgroup_add_pid_to_cgroup_cb: pid is 73568
[cpcgroup 7094 4143736640]@fw-inet2024-01[25 Mar 8:36:02] cpcgroup_add_pid_to_cgroup_cb: pid is 73569
[cpcgroup 7094 4143736640]@fw-inet2024-01[25 Mar 8:36:02] PROC_EVENT_FORK with pid: 77773
[cpcgroup 7094 4143736640]@fw-inet2024-01[25 Mar 8:36:02] PROC_EVENT_FORK with pid: 77774
[cpcgroup 7094 4143736640]@fw-inet2024-01[25 Mar 8:36:02] PROC_EVENT_FORK with pid: 77775
[cpcgroup 7094 4143736640]@fw-inet2024-01[25 Mar 8:36:02] cpcgroup_add_pid_to_cgroup_cb: pid is 73570
[cpcgroup 7094 4143736640]@fw-inet2024-01[25 Mar 8:36:02] PROC_EVENT_FORK with pid: 77776
[cpcgroup 7094 4143736640]@fw-inet2024-01[25 Mar 8:36:02] cpcgroup_add_pid_to_cgroup_cb: pid is 73571
[cpcgroup 7094 4143736640]@fw-inet2024-01[25 Mar 8:36:02] PROC_EVENT_FORK with pid: 77777
[cpcgroup 7094 4143736640]@fw-inet2024-01[25 Mar 8:36:02] cpcgroup_add_pid_to_cgroup_cb: pid is 73572
[cpcgroup 7094 4143736640]@fw-inet2024-01[25 Mar 8:36:02] PROC_EVENT_FORK with pid: 77778
[cpcgroup 7094 4143736640]@fw-inet2024-01[25 Mar 8:36:02] cpcgroup_add_pid_to_cgroup_cb: pid is 73573
[cpcgroup 7094 4143736640]@fw-inet2024-01[25 Mar 8:36:02] PROC_EVENT_FORK with pid: 77779
[cpcgroup 7094 4143736640]@fw-inet2024-01[25 Mar 8:36:02] cpcgroup_add_pid_to_cgroup_cb: pid is 73574
[cpcgroup 7094 4143736640]@fw-inet2024-01[25 Mar 8:36:02] cpcgroup_add_pid_to_cgroup_cb: pid is 73575
[cpcgroup 7094 4143736640]@fw-inet2024-01[25 Mar 8:36:02] cpcgroup_add_pid_to_cgroup_cb: pid is 73576
[cpcgroup 7094 4143736640]@fw-inet2024-01[25 Mar 8:36:02] cpcgroup_add_pid_to_cgroup_cb: pid is 73577
[cpcgroup 7094 4143736640]@fw-inet2024-01[25 Mar 8:36:02] PROC_EVENT_FORK with pid: 77780
[cpcgroup 7094 4143736640]@fw-inet2024-01[25 Mar 8:36:02] PROC_EVENT_FORK with pid: 77781
[cpcgroup 7094 4143736640]@fw-inet2024-01[25 Mar 8:36:02] cpcgroup_add_pid_to_cgroup_cb: pid is 73578
[cpcgroup 7094 4143736640]@fw-inet2024-01[25 Mar 8:36:02] cpcgroup_add_pid_to_cgroup_cb: pid is 73579
[cpcgroup 7094 4143736640]@fw-inet2024-01[25 Mar 8:36:02] PROC_EVENT_FORK with pid: 77782
[cpcgroup 7094 4143736640]@fw-inet2024-01[25 Mar 8:36:02] cpcgroup_add_pid_to_cgroup_cb: pid is 73580
[cpcgroup 7094 4143736640]@fw-inet2024-01[25 Mar 8:36:02] cpcgroup_add_pid_to_cgroup_cb: pid is 73581
[cpcgroup 7094 4143736640]@fw-inet2024-01[25 Mar 8:36:02] cpcgroup_add_pid_to_cgroup_cb: pid is 73582
[cpcgroup 7094 4143736640]@fw-inet2024-01[25 Mar 8:36:02] cpcgroup_add_pid_to_cgroup_cb: pid is 73583
[cpcgroup 7094 4143736640]@fw-inet2024-01[25 Mar 8:36:02] PROC_EVENT_FORK with pid: 77783
[cpcgroup 7094 4143736640]@fw-inet2024-01[25 Mar 8:36:02] cpcgroup_add_pid_to_cgroup_cb: pid is 73584
Regards,
Jan
TAC posted this in our case:
Solution Description: We did check this extensive logging in cpcgroup.elg issue with our product team.
Please be informed that these messages are normal and will not impact the environment.
Best to check this with TAC.
Using R81.20 T76/96/98: you have this issue on more gateways? Or the issue remained during upgrades?
Is this VSX gateway? Does this issue impact disk space? Does it rotate the file when full? (check if there is cpcgroup.elg.1 cpcgroup.elg.2 etc in same dir as cpcgroup.elg
Hello,
we have it on all VSX Gateways. It doesn't impact disk space. Rotation works. The only thing I want to know if this is normal behaviour. I find it very strange to have a file that gets flooded continoous.
I didn't want to open a case for this before knowing if this is normal behaviour.
Regards,
Jan
Open a SR# with CP TAC to learn if that is standard behaviour...
Hi,
Sorry but I think this has to be a TAC case. There is very limited info regarding this out there.
I think it is filling up a database (maybe cpview) and when it does that it prints it in this file. But again due lack of documents / sk's it is only a guess
Case is opened.
Hello,
Do you have any update on this one ?
Thanks
TAC posted this in our case:
Solution Description: We did check this extensive logging in cpcgroup.elg issue with our product team.
Please be informed that these messages are normal and will not impact the environment.
Leaderboard
Epsum factorial non deposit quid pro quo hic escorol.
| User | Count |
|---|---|
| 66 | |
| 19 | |
| 13 | |
| 12 | |
| 11 | |
| 9 | |
| 9 | |
| 7 | |
| 7 | |
| 7 |
Tue 28 Apr 2026 @ 06:00 PM (IDT)
Under the Hood: Securing your GenAI-enabled Web Applications with Check Point WAFThu 30 Apr 2026 @ 03:00 PM (PDT)
Hillsboro, OR: Securing The AI Transformation and Exposure ManagementTue 28 Apr 2026 @ 06:00 PM (IDT)
Under the Hood: Securing your GenAI-enabled Web Applications with Check Point WAFTue 12 May 2026 @ 10:00 AM (CEST)
The Cloud Architects Series: Check Point Cloud Firewall delivered as a serviceThu 30 Apr 2026 @ 03:00 PM (PDT)
Hillsboro, OR: Securing The AI Transformation and Exposure ManagementAbout CheckMates
Learn Check Point
Advanced Learning
YOU DESERVE THE BEST SECURITY