Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Morten_O
Contributor
Contributor
Jump to solution

High memory usage on 1570/1590

Hi,

we have lately hardware-refreshed a lot of 1400-appliance to mainly 1570 and 1590 models.

All are now running R81.10.10 build 996002945

A few times, we have had reports, that the appliances becomes unresponsive (not even answering ping, ssh or webui) and has to be power-cycled to start working again.

So I checked at multiple customers, and I can see, that they are all running with very high memory utilization - above 80%.

All are centrally managed, and I have seen this at multiple customers - so very different policies etc.

One of the customers is not even running IPS, which is known for intense utilization (at least on the 1400-appliances).

Are others seeing the same? Can it be a memoryleak or....?

I already opened a SR (where first recommendation was to upgrade......), but I was just interested in hearing if I'm the only one seeing this picture.

39 Replies
PhoneBoy
Admin
Admin

It is against the EULA to distribute our code outside official channels.
Please be aware of the formal escalation process for TAC here: https://www.checkpoint.com/support-services/check-point-tac-support-escalation-path/ 
Please send me the SR in a PM and I will have a look.

Amir_Ayalon
Employee
Employee

Hi All

High memory usage on Centrally managed SMB is caused by HCP (healthcheck point) in management server.

HCP tries to run some python commands on SMB appliance which doesn't support Python. Due to this, multiple sfwd instances were created and memory was not released. 

Customers will start to get the automatic HCP update in the next few days. Meanwhile, you can also update the version manually using below steps,

Download HCP TAR

https://support.checkpoint.com/results/download/134058

In Expert mode,

Run:

# autoupdatercli install <Full Path to the TAR Package

run this command to verify hcp version hcp -v

you should see or higher build:

HCP Take: 58
HCP RPM Build: hcp-1-592320.i386
hcp-1-592021.i386

 

  • Reboot the problematic SMB appliance to free the allocated memory. 
  • Once the SMB gw is up, push policy again. 
Marquevis
Participant

I didn't find the .rpm file in the link below:

https://support.checkpoint.com/results/download/134058

Is he really correct?

0 Kudos
Marquevis
Participant
  1. Download the HCP TAR

  2. Run this command in the Expert mode:

    # autoupdatercli install <Full Path to the TAR Package>

JeffCote
Explorer

I have the same issue on a centrally managed ( Cloud, SMP ) using version 81.10.10(2945).
It affects both a 1600 and a 1570.

0 Kudos
Chris_Atkinson
Employee Employee
Employee

Please check that HCP is updated on the management and if the issue persists contact support.

Note Build ending 2993 is the latest and corrects a recent OpenSSH issue.

Edit: SMP managed devices are not affected by the issue described here and will need seperate investigation. 

CCSM R77/R80/ELITE
0 Kudos
JeffCote
Explorer

These firewalls are managed through the Spark Management Platform, i'm not sure where i can see the HCP version.

0 Kudos
Tal_Paz-Fridman
Employee
Employee

HCP is not supported on Quantum Spark Appliances and does not run on Spark Management Platform (Cloud based solution)

0 Kudos
Morten_O
Contributor
Contributor

It sounds like to root-cause has been found, even though I still haven't seen any of the 15xx's going with less memory-usage, but let's hope this will happen during this week.

I have a question though. HCP is a passive tool, right, which has to be run maunally. The Spark appliances doesn't even support HCP. So how can a HCP on the managementstations cause this issue?

PhoneBoy
Admin
Admin

HCP on the management does monitor gateways (including SMB ones).

0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events