High Memory after Install 110Take

[Kolafer]

Hello Community,

do someone make someone experience with high memory after upgrade the getaway with R81.10 Take 110?

Model: Check Point 23800
Version: R81.10 Take 110

Only Firewall Blade and PEP/PDP enabled on the firewall. CPU Util looks good.

What are this processes ?

in.aftpd
in.emaild.pop
in.asmtpd

Thanks 

[Timothy_Hall]

Do you have the DLP or Content Awareness blades enabled?  Those features take advantage of the in.aftpd daemon and you seem to have an awful lot of them.

[Kolafer]

Hi,

no only FW and IA

[Expert@FW]# enabled_blades
fw identityServer

[Timothy_Hall]

I can't think of any valid reason why those three security server processes (and so many of them) are running on your gateway with only those blades enabled unless you are utilizing legacy User/Client/Session authentication actions in your rulebase which is unlikely.  This behavior seems like a bug to me especially since you just updated your HFA level.  Probably going to have to get TAC involved, or you could try backing out the HFA.

[the_rock]

I would also suggest TAC case for this.

Andy

[PhoneBoy]

Best to get the TAC involved here: https://help.checkpoint.com

[the_rock]

Can you also send us output of below commands?

cpview (look for memory usage)

ps -auxw

top

free -g

cpwd_admin list

Andy

[Kolafer]

Hi Rock,

here the output. I will also open TAC on monday. 

Thanks

[genisis__]

If this does turn out to be a bug, please let the community know, ideally with a bug id.

[the_rock]

Tx @Kolafer , will check tomorrow after I do my 50k bike ride 🙂

Andy

[the_rock]

Ok, just had a chance to look at it...I find the issue a bit odd, because based on what you sent, appears you have lots of memory free, as a matetr of fact, shows 30 GB free.

Also, cpu seems fine to me. Processes you asked about are related to security servers. Do you have any sort of client auth configured?

Kind regards,

Andy

[Chris_Atkinson]

Recommend upgrading to T113 and above or reviewing the work arounds per sk180505.

[genisis__]

T113 has been in 'ongoing' status for a little longer than normal, but I would expect this to be GA very soon.

[the_rock]

Thats true, but I would personally not bother until it is marked as recommended.

Andy

[Kolafer]

Hi Chris,

I checkt the output on the firewall from the sk180505.

It look similar.

[Kolafer]

add information.

we have also some other processes running, which are not included in the sk180505