fwloghandle_register_string: unable to put entry into table

[Exonix]

Hello everyone and Merry Christmas to whom it concerns,

we have a management server R80.40 and three Security Gateways: two 75.40 and one 80.30.

On the 75.40 gateways we can't install any policy any more. The main error says "Load on module failed - no memory" although there is more than 30% RAM on each server. Using sk101875 I read the logs:

Dec 24 10:30:44 2021 bes009 kernel: FW1: fwloghandle_register_string: unable to put entry into table.

Dec 24 09:50:18 2021 bes010 kernel: [fw_0];FW1: fwloghandle_register_string: unable to put entry into table.
Dec 24 09:50:18 2021 bes010 kernel: [fw_0];FW-1: SIM (SecureXL Implementation Module) SecureXL device detected.

I've got the same error even installing policy via cli:

install-policy policy-package "my_policy_name" access true threat-prevention true targets.1 "bes009" --version 1.2

Then I've found another article, but it is not from CheckPoint - the link. Can I trust this source? If not, how can I fix this issue?

Thank you in advance.

[the_rock]

O man...R75.40...okay, wont go on a rant now about a version, all good :-). Anyway, I can say this...literally, in all my years dealing with CP, I had only seen that error once and I asked customer to reboot the box and it fixed the issue and never happened again after. However, if you did do a reboot and problem is still there, you may need to check if there is specific process causing an issue that might need to be debugged. 

By the way, do any of those scenarios from the SK apply to you?

Andy

[genisis__]

With the load on module failure message, I generally found (back in the day) disabling hit counts did the trick.

[the_rock]

I was literally about to post that, but you beat me to it :-). I actually look through my emails and saw an email with exact same reasoning that I had one customer do while back. Cant say it applies to any version, but absolutely worth a try.

Andy

[Exonix]

Hi Andy,

yes, the verison is old and we are working on its upgrade. But now I have to fix what we have...

The first scenario has the same solution like article from broadcom has. So, we will try to execute "fw tab -t string_dictionary_table -x" because it doesn't require a reboot

[Tal_Paz-Fridman]

Hi

Aside from the suggestions from the specific issue, R75.40 has reached the end of support in April 2016 so it will be beneficial to move to a newer one.

https://www.checkpoint.com/support-services/support-life-cycle-policy/#software-support

[Exonix · Accepted solution]

workaround "fw tab -t string_dictionary_table -x" helps for a while, but after few hours it happens again

[genisis__]

Not sure I would do this.  The way I read the above a table called "string_directory_table" will be emptied immediately, this could cause service interruptions (I'm assuming your running this on a GW??)

Also the link suggest exactly what I said which is to disable to the hit counts log (which is done via SmartConsole). I could not find the SK it mentions.

The bigger challenge you face is the fact you are still running R75.x, and I suspect on discounted hardware.