Checkpoint gateway Memory Usage

[gemechisd]

We have checkpoint security gateway 7000 appliance. Recently the memory usage is above 90%. How can we know, which process is running more memory?

[gemechisd]

@Sorin_Gogean @the_rock 

We see memory increase in last two weeks, not after appliance restart. 

For the log server, we have been using the SMS as a log server. But not the gateway.

Here is the scenario. Last week I have been observing 81% memory usage. Then, this week it's 97-98%. The firewall is not upgraded. We have 2 gateways configured as a cluster. Before two months the standby gateway failed and now we are on the process of acquiring a new gateway for the standby. 

Currently we are working with one gateway only. So, we haven't installed any Jumbo Hotfixes and Takes since the one gateway fails. Now, the last take installed is 173. There is no additional blade enabled. Last month we have purchased remote VPN license for 200 users and attached the license to the gateway.

[Sorin_Gogean]

Hello @gemechisd ,

Understood, so in regards to the memory usage increase, I told you earlier that there are couple of reasons, but keep in mind that it's normal for the box to use the memory.

As for the failed stand-by member, doesn't it covered by support contract, therefore an RMA should get you solved, or we're talking about older appliances and not Quantum 7000 ?

Can you please do "Execute the command enabled_blades in expert mode" like @PhoneBoy asked, and get back to us. It would show smth like:

[Expert@AXXX-FW02:0]# enabled_blades
fw urlf av appi ips identityServer SSL_INSPECT anti_bot ThreatEmulation mon
[Expert@AXXX-FW02:0]#

Thank you,

PS: the only way to reduce memory utilization is to drop blades that you're not using, and like I said, high memory is normal in certain situations, depending on the traffic you have.... 

PS2: go and open SmartView Monitor, and you can open an "Firewall History" Report (add additional counters like I have in the screenshot below) and you will get a response what triggered the memory increase, if it was due to traffic) . As  you see on mine, as soon as we put traffic through the box, we got 1-1.5Gb extra utilization, and that will increase in a week for sure.....

[the_rock]

Please send us output of enabled_blades, like few guys already asked, it will help.

Cheers,

Andy

[the_rock]

Also, below links are hopefully useful as well:

https://community.checkpoint.com/t5/Security-Gateways/High-memory-usage/td-p/67734

https://community.checkpoint.com/t5/General-Topics/Physical-memory-is-high/td-p/32267

https://community.checkpoint.com/t5/Security-Gateways/Gateway-Firewall-running-above-90-Memory-usage...

https://community.checkpoint.com/t5/Security-Gateways/Gateway-Firewall-running-above-90-Memory-usage...

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

https://community.checkpoint.com/t5/Management/fw-full-High-Memory-R80-30/m-p/80246

https://community.checkpoint.com/t5/Management/fw-full-High-Memory-R80-30/m-p/80246

Dont worry mate, as a team, we WILL solve this 💪

Andy

[Chris_Atkinson]

There are several memory consumption fixes in newer Jumbo takes after take 173.

The only unknown here appears to be how much traffic the gateway is handling in terms of volume of connections etc?

1. If the issue persists after upgrading to a new jumbo please engage TAC 

2. Capacity/sizing may warrant upgrading memory to 64GB for longevity given the enabled blades. 

[the_rock]

Im with @Sorin_Gogean on this. We need to get more details, for sure. If you say this happened since about 2 weeks ago, it would be nice to know what changes could have caused it. Was fw upgraded, additional blades enabled, anything else?