Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Hllrdm
Contributor
Jump to solution

RAD's high utilization

Hello.

We at the Security Gateway have found that our RAD process loads the CPU heavily.
Is there any debugging of this process to understand why it loads the CPU?
Maybe we can look at the buffer?

0 Kudos
2 Solutions

Accepted Solutions
Chris_Atkinson
Employee Employee
Employee

Source sk163793 but as above if it's really high please review the other reference SK  provided. Might require anti-malware cache tuning etc.

If the issue persists there after please contact TAC.

CCSM R77/R80/ELITE

View solution in original post

Chris_Atkinson
Employee Employee
Employee

 

What is the actual problem (user symptom) that you're trying to troubleshoot and is TAC engaged?

1.) Manage & Settings > Blades > Application Control & URL Filtering > Check Point online web service > Website categorization mode: Hold / Background / Custom.

2.) Manage & Settings > Blades > Threat Prevention > Check Point Online Web Service > Resource classification mode: Hold / Background / Custom.

CCSM R77/R80/ELITE

View solution in original post

10 Replies
Chris_Atkinson
Employee Employee
Employee

From R80.40 RAD is multi-threaded, you will see more RAD processes, and CPU can exceed 100%. Within reason this is a usual behavior.

If you're seeing excessive numbers (500%) see sk167553 section 4.7.4

CCSM R77/R80/ELITE
Hllrdm
Contributor

Is there any confirmation in sk or additional documentation that says this is expected behavior?

0 Kudos
Chris_Atkinson
Employee Employee
Employee

Source sk163793 but as above if it's really high please review the other reference SK  provided. Might require anti-malware cache tuning etc.

If the issue persists there after please contact TAC.

CCSM R77/R80/ELITE
Hllrdm
Contributor

Thank you. Could you please tell us how we can view the buffer of this process. We have a suspicion that our buffer is full, because the mode is hold

0 Kudos
Chris_Atkinson
Employee Employee
Employee

For the various services leveraging RAD please see the commands in sk105179 (AV/AB) & sk64280 / sk90422 (URLF).

 

CCSM R77/R80/ELITE
0 Kudos
Hllrdm
Contributor

Unfortunately, I could not find a command to check the buffer for the RAD service. Have you come across such a need?

0 Kudos
G_W_Albrecht
Legend
Legend

See sk90422 - How to modify URL Filtering cache size?

CCSE CCTE CCSM SMB Specialist
0 Kudos
Chris_Atkinson
Employee Employee
Employee

The knowledge base article IDs I provided include these commands.

Please explain what you are attempting to check more clearly?

 

 

CCSM R77/R80/ELITE
0 Kudos
Hllrdm
Contributor

Can you tell me how to remove the hold action for entries in the RAD process? Our records also have a hold action.

0 Kudos
Chris_Atkinson
Employee Employee
Employee

 

What is the actual problem (user symptom) that you're trying to troubleshoot and is TAC engaged?

1.) Manage & Settings > Blades > Application Control & URL Filtering > Check Point online web service > Website categorization mode: Hold / Background / Custom.

2.) Manage & Settings > Blades > Threat Prevention > Check Point Online Web Service > Resource classification mode: Hold / Background / Custom.

CCSM R77/R80/ELITE

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events