fw_full process consumes 100% CPU

[Nischit_Aryal]

Hi,

Sometimes, the fw_full process seems to be on 100%. Please refer the attached screenshot. I found the SK regarding this issue but still I thought of asking in this Community. Has anyone faced this issue? If yes, please help me resolve this issue.

Thanks in advance.

Sincerely,
Nischit A.  

[PhoneBoy]

It would be helpful if you provided some basic details about your configuration, such as:

• Version
• Jumbo Hotfix level
• Blades in use

Also, there are several SKs that mention fw_full with high CPU.

Which ones did you review?

[JozkoMrkvicka]

You have 3 zombie processes. It shouldnt be related, but you never know  Check it out.

[Nischit_Aryal]

Hi,

Please find below the outputs of Version, Jumbo Hotfix Level and blades in use

[Expert@CP-Sec:0]# enabled_blades
fw vpn av ips anti_bot

[Expert@CP-Sec:0]# cpinfo -y all

This is Check Point CPinfo Build 914000176 for GAIA
[FW1]
HOTFIX_R77_30
HOTFIX_GEYSER_PINK6_HF
HOTFIX_R77_30_HF5_PINK_PERF_003
HOTFIX_GEYSER_HF_BASE_861
HOTFIX_R77_30_JUMBO_HF Take: 286

FW1 build number:
This is Check Point Security Management Server R77.30 - Build 013
Installed Plug-ins:
This is Check Point's software version R77.30 - Build 092
kernel: R77.30 - Build 092

[SecurePlatform]
HOTFIX_GAIA_GEYSER_PINK6_HF
HOTFIX_R77_30_JUMBO_HF Take: 286

[PPACK]
HOTFIX_R77_30
HOTFIX_GEYSER_PINK6_HF_001
HOTFIX_R77_30_JUMBO_HF Take: 286

[CPinfo]
No hotfixes..

[SmartPortal]
HOTFIX_R77_30_JUMBO_HF Take: 286

[Reporting Module]
HOTFIX_R77_30
HOTFIX_R77_30_JUMBO_HF Take: 286

[CPuepm]
HOTFIX_R77_30
HOTFIX_R77_30_JUMBO_HF Take: 286

[CVPN]
HOTFIX_R77_30
HOTFIX_R77_30_HF5_PINK_PERF
HOTFIX_R77_30_JUMBO_HF Take: 286

[SmartLog]
HOTFIX_R77_30
HOTFIX_R77_30_JUMBO_HF Take: 286

[SFWR77CMP]
HOTFIX_R77_30

[R7520CMP]
HOTFIX_R77_30

[R7540CMP]
HOTFIX_R77_30

[R7540VSCMP]
HOTFIX_R77_30

[R76CMP]
HOTFIX_R77_30

[R75CMP]
HOTFIX_R77_30

[NGXCMP]
HOTFIX_R77_30

[V40CMP]
HOTFIX_R77_30

[EdgeCmp]
HOTFIX_R77_30

[SFWCMP]
HOTFIX_R77_30

[FLICMP]
HOTFIX_R77_30

[CON66CMP]
No hotfixes..

[SFWR75CMP]
HOTFIX_R77_30

[CPUpdates]
BUNDLE_R77_30_JUMBO_HF Take: 286

[DIAG]
HOTFIX_R77_30

[rtm]
No hotfixes..

[PhoneBoy]

Which SKs did you review about this problem?

As I said, there are a few of them and it wasn't clear which one you thought might be appropriate.

[Nischit_Aryal]

Hi Dameon,

It's sk119841 that I think might be appropriate. I haven't tried anything else in my appliance thinking this might be a common issue and someone from this community has faced this issue. 

[PhoneBoy]

This SK mentions other symptoms, do they apply to you?

What about some of the other SKs that mention fw_full and high CPU?

• fw_full process has high CPU usage and /var/log/messages file filled with traffic logs 
• "fw_full" process / "fwd" process on Security Gateway consumes CPU at high level when NAT configured... 
• High CPU utilization when "Enable deep inspection scanning" is enabled 

If none of these apply, it's probably time to get the TAC involved to help troubleshoot further.

[Nischit_Aryal]

Hi Dameon,

I will check if the symptoms matches any of the SK and follow SK based on the symptoms. I will share it if the issue gets resolved. Thanks for your help Dameon!