Checkpoint CP 790 fwtmp almost full

[mischelw]

I can see the fwtmp folder is almost full (97%) and never gets cleared. i'm afraid it will go to 100% and i will be down.

How can this folder be cleaned ? i can see also that the CPU is very high, though not much of traffic at that time.

Appreciate any help.

Willy.

[PhoneBoy]

Are you experiencing any actual issues as a result of this?

[mischelw]

I can see high cpu than normal.

I have cleaned the directory following the instructions sent by CP support and now I cannot load my tule base anymore, getting an error that the device cannot load the rules... 

[PhoneBoy]

What precise errors?

[mischelw]

 I'm so afraid to restart the device, as i must stay online, if the device dies on me (which seems this is what is happening...) would be very problematic 🙂

any ideas ?

[Amir_Ayalon]

Hi

in some cases, there is a bug in fwtmp which can cause it.

it is solved in 990173072

5 December 2020: Build 990173072 is the latest R77.20.87

Thanks

[G_W_Albrecht]

I know at least 6 old SKs about fwtemp issues that mostly were resolved in the next firmware version. Will a sk be available about this bug ? Most customers have to install new builds manually - as the WebGUI does not show the new version and sk153433 gives no details what had been fixed in 990173072, it could easily get an overlooked build...

[Amir_Ayalon · Accepted solution]

Hi

let me try to give some more details

APPI package which is downloaded from the cloud (~3MB) is kept in /fwtmp and may be replaced upon an new APPI update.
The issue was that when the file is being replaced with the new version, in some cases, some processes still kept the original (deleted) file open. This prevented the original file from actually being released, and those ~3MB were still considered as used in the /fwtmp partition.
This decreased the available space in /fwtmp.

this issue require certain scenario to happen, so it's not common, but in any case, issue was fixed on 990173072

990173072 is available in the vSMP for domains that require an upgrade.

Thanks

[mischelw]

Thank you.

I will try to upgrade as soon as I can take the site offline for that period hoping that it will not reoccurred...

[mischelw]

Well, another restart (2 times) , through the webui, seems to solved the error message and cleaned up the fwtemp folder , now at 60% usage. i'll keep monitoring this, as i tend not to install updates if they are not appearing on the firewall or are not truly necessary. cannot afford downtimes... 

Why they are not formally published ?

[PhoneBoy]

We are only releasing JHF builds for the 7xx/14xx appliances against R77.20.87.
Public JHF releases are published in sk153433 but not released in the WebUI updates, to my knowledge.