High CPU usage on security gateway after R80.10 Fresh install

[Silvan_Nyambu1]

Hi, i am having a distributed environment of one Smartcenter and one security firewall both running on R80.10, but previously they were both running on R77.30

I recently i did a fresh install of R80.10  on both the management and the Checkpoint 5400 security firewall but after like 5 days i started experiencing very High  CPU usage on the firewall. When i check the processes running from the top command i found out that gzip process was the one consuming most of the firewall resources and no backup was being done at the moment.

I had a chat with one of Checkpoint technical engineers and told me to do a restart of the firewall and if it fails i do another fresh install of R80.10.

I did a restart of the firewall and the CPU usage came down but after a week it came up again. I therefore proceeded with doing a fresh install of R80.10 on the firewall but i was still experiencing the same issue.

Now i have downgraded the gateway to R77.30 and its working fine, the management is on R80.10. Still today i haven't found a solution for the previous problem. I experienced this problem with more than one client, others however  were generating some error message codes when installing policies to the gateway which I've never seen before not even in support center.

If anyone has a solution to this i would really appreciate. 

[Timothy_Hall]

Use the pstree command to identify the parent process of gzip as discussed in this thread:

https://community.checkpoint.com/message/7514-re-strange-processes-in-r8010-gw?commentID=7514?sr=sea... 

Next this sk will help you identify what feature/blade the offending process is associated with:

sk97638: Check Point Processes and Daemons

If I had to take a wild guess I'd say it is probably related to CPUSE (DAService process), archive scanning in the Anti-virus blade, or scheduled backups.

--
My book "Max Power: Check Point Firewall Performance Optimization"
now available via http://maxpowerfirewalls.com.

[cstueckrath]

try pressing "c" while in top. It will show the command gzip was started with.

[Laurent_Vanhees]

Hello,

Do you have a solution?

We are experiencing the same issue. GZIP process is running at 100% and the load of the gateway is quite high.

No able to install policy anymore "problem with the commit function".

Thanks,
Regards,
Laurent

[PhoneBoy]

Test