Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
fabionfsc
Contributor

FWD proccess high CPU usage

Hello, everyone, how are you?

We have a problem with a client (R81.20 Take 89 ClusterXL) whose log sending process (fwd) is always using a high CPU and the logs take about 10 minutes to be displayed in SmartConsole. The SMS CPU is not high, but the Cluster itself has a LOT of traffic and the CPU is always high during peak hours.

I would like someone to confirm something for me: is it true that, in versions up to R81.20, the fwd process is single-core by design? Is it true that in R82 the fwd process is now multi-threaded?

Personally, I would really like to implement the R82 version in this environment, but I am very worried about the problems that may arise, since there is no Take available yet.

0 Kudos
4 Replies
PhoneBoy
Admin
Admin

fwd is typically operating on shared cores. 
Dedicating a core to fwd might be helpful: https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_PerformanceTuning_AdminGuide... 

I'm fairly certain fwd is single core and also heard that was supposed to change in R82.
Don't know for certain if it is, though.

0 Kudos
fabionfsc
Contributor

I spent the whole afternoon testing this issue in Lab and came to the following conclusions:

• When the FW has few Cores, the fwd process can be used by any CoreXL or CoreSND, but it will always be assigned to only ONE CoreXL or CoreSND, as if the process really had this limitation of being single-core (perhaps an issue with Kernel 3.14 used up to version R81.20).

• When the FW has many Cores, GAiA itself seems to create a Core only for the fwd process (this is exactly about the documentation you sent, but GAiA does this automatically in the First Wizard).

The documentation you sent is to be used in the first case, where the FW has few cores and no specific core is set for the fwd. By doing the documentation, you set a core to be responsible only for the fwd process.

In a Lab (ESXi) I created a VM with 28 cores, look at the behavior in R81.20:
R81.20.png

I did the documentation you mentioned, with the intention of adding another core for the fwd process, but it doesn't work, only one core is allowed for the fwd process. In this specific client that I mentioned, the boxes are well designed and GAiA has already automatically set a core for the fwd process. I can't put 2 cores for the fwd process, for example.

Now, look at how the R82 version turned out. No specific core was set for fwd, I believe that in the R82 version, the fwd process is now multi-threaded, this was said in the EA version of R82:
R82.png

 

0 Kudos
PhoneBoy
Admin
Admin

Here's what the R82 Release Notes say: 

  • Quantum Security Gateway log rate output capacity increased by up to 100% through a new multi-process architecture.

That would imply either fwd is mutli-core or a new process that is multi-core is handling logging.

0 Kudos
the_rock
Legend
Legend

Hey bro, hows life? Hope you are well. Not sure if this might be applicable, but maybe worth checking?

Andy

https://supportcontent.checkpoint.com/solutions?id=sk30908

0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events