Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
BrunoCiongoli
Participant

Ted.elg increased a lot

Hi checkmates, I have a problem:

 

The file "ted.elg" increase a lot and this fills the disk in the active gateway. The Threat Emulation and Threat Extraction blades are not enabled.

 

We are running a cluster in R80.40

 

This appears in the ted.elg file (attached image) 

 

Did anything like that happen to anybody else?

 

 

 

0 Kudos
13 Replies
the_rock
Champion
Champion

Hey Bruno,

Cant say I ever seen that issue happen myself. Can you ensure there is nothing in threat prevention policy enabled for those blades? I checked my 2 lab fw's and both have this file with size less than 200 Kb.

Andy

Screenshot_1.png

0 Kudos
BrunoCiongoli
Participant

Hi andy thanks for the response

No, nothing in threat prevention policy is installed on this GW

 

regards

0 Kudos
the_rock
Champion
Champion

Can you send a screenshot?

Andy

0 Kudos
BrunoCiongoli
Participant

Yes, of course

This TP policies are for another cluster and are instaled on that cluster. The GW what have this issue is the one in the other image

0 Kudos
the_rock
Champion
Champion

What happens if you delete the file? Does it go back to unusual size after some time?

0 Kudos
BrunoCiongoli
Participant

Yes, after delete this file it returned to unusual sizes and again fills the disk after some time, it never stops typing it with the same error ( the error of the image that I sent in the original post)

0 Kudos
the_rock
Champion
Champion

As last resort, if you can reboot fw, try that. If not, I would suggest contact TAC, this is worth investigating more.

0 Kudos
BrunoCiongoli
Participant

We reboot the cluster and the problem happened in the another cluster member too.

0 Kudos
the_rock
Champion
Champion

Definitely get in touch with TAC.

0 Kudos
BrunoCiongoli
Participant

Thanks for your time, we’ll open a case

0 Kudos
the_rock
Champion
Champion

Im really sorry, I wish I could have given you some sort of good suggestion. I never seen this problem before, so not really sure why it happens. Maybe someone else in the community will have an idea...one thing though that came to my mind is, can you run ps -auxw command and top as well, just to see if there is a process that could be consuming high memory/cpu that might potentially cause this to happen?

Andy

0 Kudos
BrunoCiongoli
Participant

Here are the outputs

0 Kudos
the_rock
Champion
Champion

Just a shot in the dark here...but, one that that struck me from those outputs is that fwd is consuming unusually high amount of cpu, 30 plus % and then all fw workers about 10% each, which amount to more than 60% right there. I know this might be a bit extreme to try, but just to be 100% positive its not corexl related, if its enabled, I would try disable it as a test and reboot (can be done via cpconfig command). Not sure if thats something you could try, but it would be worth, just to confirm, for sure.

0 Kudos