FWD process consumes CPU/memory at high level on Multi-Domain Management Server when LEA clients are connected to it

Product Multi-Domain Security Management, SmartEvent / Eventia Analyzer

Version R80.40 (EOS), R81 (EOS), R81.10 (EOS), R81.20, R82, R82.10

OS Gaia

Last Modified 2025-04-11

Symptoms

• FWD process (Log Server) consumes CPU/memory at high level on Domain Management Server / Domain Log Server when LEA clients are connected to it.
• FWD process stops working producing with cores dump files on Domain level, and the size of the core dump files is ~2G, which indicates high usage of memory and failure to allocate more memory.
• LEA clients fail to connect to the FWD (LEA server) and the fwd.elg file contains these errors:

  opsec_new_auth_conn_to_server: conn from <client IP> to entity lea_server (0x....) failed (0) No SIC error message
  lea_server_session_start: too many session established already: 10. session will be rejected for this request.

Cause

FWD daemon might be busy with both writing the information to log file and forwarding this information to SmartEvent/SmartReporter or any other 3rd party LEA client (such as "Arcsight") via LEA session.

Each session requires high usage of memory. Therefore, multiple sessions cause FWD to run out of memory.

Solution

Follow these steps:

1. Go to the context of relevant Domain Management Server / Domain Log Server: [Expert@HostName:0]# mdsenv <IP address of Name of Domain Management / Log Server>
2. Stop the relevant Domain Management Server / Domain Log Server: [Expert@HostName:0]# mdsstop_customer <IP address of Name of Domain Management / Log Server>
3. Spawn LEA sessions to separate process to run on different CPU cores: [Expert@HostName:0]# $CPDIR/bin/cpprod_util CPPROD_SetValue FW1//6.0 Spawn_LEA 4 1 1
4. Start the relevant Domain Management Server / Domain Log Server: [Expert@HostName:0]# mdsstart_customer <IP address of Name of Domain Management / Log Server>
5. After restarting a Domain Log Server, it is recommended to fetch the logs from the relevant Security Gateways.

In SmartView Tracker, go to the Tools menu - click on the Remote Files Management - select the relevant Security Gateway - click on the Get File List... button.

Notes:

• To check the current version of Spawn_LEA, run:

[Expert@HostName:0]# grep Spawn_LEA $CPDIR/registry/HKLM_registry.data

• If Spawn_LEA is not found in Check Point registry, then it is not currently set
• If output shows :Spawn_LEA ("[4]1"), then it was manually "enabled"
• If output shows :Spawn_LEA ("[4]0"), then it was manually "disabled"
• On Security Management Server, spawning of LEA sessions is activated by default.
• To deactivate spawning of LEA sessions on relevant Domain, follow the above instructions, and in Step 3 run: [Expert@HostName:0]# $CPDIR/bin/cpprod_util CPPROD_SetValue FW1//6.0 Spawn_LEA 4 0 1

Article Properties

Access Level General

Status Approved

Date Created 2013-01-14

Last Modified 2025-04-11