Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
BrunoCiongoli
Collaborator

Ted.elg increased a lot

Hi checkmates, I have a problem:

 

The file "ted.elg" increase a lot and this fills the disk in the active gateway. The Threat Emulation and Threat Extraction blades are not enabled.

 

We are running a cluster in R80.40

 

This appears in the ted.elg file (attached image) 

 

Did anything like that happen to anybody else?

 

 

 

0 Kudos
16 Replies
the_rock
Legend
Legend

Hey Bruno,

Cant say I ever seen that issue happen myself. Can you ensure there is nothing in threat prevention policy enabled for those blades? I checked my 2 lab fw's and both have this file with size less than 200 Kb.

Andy

Screenshot_1.png

0 Kudos
BrunoCiongoli
Collaborator

Hi andy thanks for the response

No, nothing in threat prevention policy is installed on this GW

 

regards

0 Kudos
the_rock
Legend
Legend

Can you send a screenshot?

Andy

0 Kudos
BrunoCiongoli
Collaborator

Yes, of course

This TP policies are for another cluster and are instaled on that cluster. The GW what have this issue is the one in the other image

0 Kudos
the_rock
Legend
Legend

What happens if you delete the file? Does it go back to unusual size after some time?

0 Kudos
BrunoCiongoli
Collaborator

Yes, after delete this file it returned to unusual sizes and again fills the disk after some time, it never stops typing it with the same error ( the error of the image that I sent in the original post)

0 Kudos
the_rock
Legend
Legend

As last resort, if you can reboot fw, try that. If not, I would suggest contact TAC, this is worth investigating more.

0 Kudos
BrunoCiongoli
Collaborator

We reboot the cluster and the problem happened in the another cluster member too.

0 Kudos
the_rock
Legend
Legend

Definitely get in touch with TAC.

0 Kudos
BrunoCiongoli
Collaborator

Thanks for your time, we’ll open a case

0 Kudos
the_rock
Legend
Legend

Im really sorry, I wish I could have given you some sort of good suggestion. I never seen this problem before, so not really sure why it happens. Maybe someone else in the community will have an idea...one thing though that came to my mind is, can you run ps -auxw command and top as well, just to see if there is a process that could be consuming high memory/cpu that might potentially cause this to happen?

Andy

0 Kudos
BrunoCiongoli
Collaborator

Here are the outputs

0 Kudos
the_rock
Legend
Legend

Just a shot in the dark here...but, one that that struck me from those outputs is that fwd is consuming unusually high amount of cpu, 30 plus % and then all fw workers about 10% each, which amount to more than 60% right there. I know this might be a bit extreme to try, but just to be 100% positive its not corexl related, if its enabled, I would try disable it as a test and reboot (can be done via cpconfig command). Not sure if thats something you could try, but it would be worth, just to confirm, for sure.

0 Kudos
JeffersonRomero
Participant
Participant

Hi Bruno

Did you solve it? I have the same behavior in a cluster in R81.10 ...

Regards

JR

0 Kudos
Chris_Atkinson
Employee Employee
Employee

TE is not enabled?

Does the following command return output?

tecli advanced attributes show | grep -i log

CCSM R77/R80/ELITE
0 Kudos
Shiran_Gold
Employee
Employee

Hi Jefferson,

 

I have sent you a direct message, please check your inbox.

I would like to get more details about the behavior.

 

BR,

Shiran

0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events