Memory leak on management server

[Julio_Rugel]

Good day,

I have two management servers in version R80.40, installed on vmware, each one manages a single cluster, I comment on the antecedent:
- In version R80.10 the managements worked with 12 GB of RAM without problem.
- They are management, log server and event server in one.
- In R80.40 the memory reached a consumption of 98% so a sizing was carried out, showing that the peak of logs per day is 1.6GB.
- Based on the cploginvetigator.sh it is recommended to increase the memory to 32 GB. The computer worked well for a couple of weeks and then 98% of the RAM was consumed again.
- I opened a case with the TAC and recommended uploading to 64 GB without explanation of why. The customer does not agree as it is not justified that in R80.10 it worked well with 12 GB and now 64GB is needed without explanation.
- The client was convinced to increase the memory to 48 GB, the manegemnt worked well for a few days and now we have more than 85% consumption.
- In the vmware console the memory consumption does not reach 25%, but in the GAIA values ​​greater than 80% are always shown, with 48GB.
- The virtual machine was created with all the features of sk104848.

A long time has passed and the TAC does not give me a definitive solution, I need an urgent solution.

Do you have any recommendations?

Please help me.

note: at this time it is not possible to separate the management, log server and events functionalities

[PhoneBoy]

Precisely how are you measuring consumption?
From what I understand, the management allocating most of the available RAM is quite normal and isn't necessarily indicative of a problem.
If the memory were really used, you'd also see it in VMware, which you're saying is not the case.

Are there any other issues resulting from this or is the concern it is showing the memory being used?

[Bob_Zimmerman]

Expanding on this specifically, unused RAM is wasted RAM. It's normal for Linux/UNIX systems to report over 90% memory consumption by some metrics, because they use RAM to cache data so they don't have to hit the disk as often. What matters is the distribution of the consumed RAM (used, free, shared, buff/cache, available), and whether swap is being used. Here's an example from my personal development box:

[Expert@LabSC]# uname -a
Linux LabSC 3.10.0-957.21.3cpx86_64 #1 SMP Sun Apr 18 18:41:00 IDT 2021 x86_64 x86_64 x86_64 GNU/Linux
[Expert@LabSC]# fw ver
This is Check Point's software version R80.40 - Build 121
[Expert@LabSC]# free -h
              total        used        free      shared  buff/cache   available
Mem:           7.5G        3.5G        405M         46M        3.6G        3.3G
Swap:          7.7G         73M        7.6G

Only 405 MB out of 8 GB is free, so that's about 95% used, right? Well, it's a bit more complicated. Shared memory and buffer/cache memory count against free memory, but they are very low-priority uses. Anything can evict those pages from RAM if the space is needed. Available is a much better measure, and as you can see, I have about 43% of my RAM available. Some shared and most buffer/cache RAM does not count against available memory.

[G_W_Albrecht]

What happens after a reboot ? If this is a memory leak, used RAM would be much less afterwards.

[G_W_Albrecht]

You wrote:

effectively when I restart the management the memory consumption is 12% but after one or two days the consumption rises again.

Have you installed the most recent GA Jumbo Take ?