RAD's high utilization

[Hllrdm]

Hello.

We at the Security Gateway have found that our RAD process loads the CPU heavily.
Is there any debugging of this process to understand why it loads the CPU?
Maybe we can look at the buffer?

[Chris_Atkinson]

From R80.40 RAD is multi-threaded, you will see more RAD processes, and CPU can exceed 100%. Within reason this is a usual behavior.

If you're seeing excessive numbers (500%) see sk167553 section 4.7.4

[Hllrdm]

Is there any confirmation in sk or additional documentation that says this is expected behavior?

[Chris_Atkinson · Accepted solution]

Source sk163793 but as above if it's really high please review the other reference SK  provided. Might require anti-malware cache tuning etc.

If the issue persists there after please contact TAC.

[Hllrdm]

Thank you. Could you please tell us how we can view the buffer of this process. We have a suspicion that our buffer is full, because the mode is hold

[Chris_Atkinson]

For the various services leveraging RAD please see the commands in sk105179 (AV/AB) & sk64280 / sk90422 (URLF).

[Hllrdm]

Unfortunately, I could not find a command to check the buffer for the RAD service. Have you come across such a need?

[G_W_Albrecht]

See sk90422 - How to modify URL Filtering cache size?

[Chris_Atkinson]

The knowledge base article IDs I provided include these commands.

Please explain what you are attempting to check more clearly?

[Hllrdm]

Can you tell me how to remove the hold action for entries in the RAD process? Our records also have a hold action.

[Chris_Atkinson · Accepted solution]

What is the actual problem (user symptom) that you're trying to troubleshoot and is TAC engaged?

1.) Manage & Settings > Blades > Application Control & URL Filtering > Check Point online web service > Website categorization mode: Hold / Background / Custom.

2.) Manage & Settings > Blades > Threat Prevention > Check Point Online Web Service > Resource classification mode: Hold / Background / Custom.