traffic issues, log flooded with errors

[Wolfgang]

We had some traffic issues, broken connections, slowness etc.

/var/log/messages is flooded:

[fw4_0];tcp_input: could not add pkt_buf to rcv queue
[fw4_1];tcp_input: could not add pkt_buf to rcv queue
[fw4_1];tcp_input: could not add pkt_buf to rcv queue
[fw4_0];tcp_input: could not add pkt_buf to rcv queue
[fw4_0];tcp_input: could not add pkt_buf to rcv queue
[fw4_2];tcp_input: could not add pkt_buf to rcv queue

Nothing found in the knowledgebase. Maybe someone has an idea?

[Chris_Atkinson]

Is the gateway or interface/s showing signs of heavy load in combination with these messages?

[Wolfgang]

No, only 250Mbit/s on a 5600 appliance. Shown messages appears all the time every second.

We switched the active node to the other cluster member and the traffic issues are gone. On the now standby node  /var/log/messages are still flooded with the same messages. All memory on this node is in use. Im sure a reboot solve the problem but maybe ther's something to investigate.

[Chris_Atkinson]

How much RAM is it populated with (32G) and a recent JHF and how much uptime?

[Wolfgang]

16GB RAM (used all)

latest recommended Jumbo R80.40

3 month uptime

[Hugo_vd_Kooij]

Before you reboot, make sure to run cpinfo to record the situation with the memory pressure.

[the_rock]

Good point, because more info there is before reboot for TAC investigation, the better.

Andy

[the_rock]

Maybe below is helpful?

Andy

https://community.checkpoint.com/t5/General-Topics/Problem-with-5400-device-after-firmware-upgrade-t...

[Wolfgang]

@the_rock we are running R80.40

[the_rock]

I know you are, but honestly, thats literally ONLY thing I found related to what you asked, sorry.

Andy