The information you are about to copy is INTERNAL!
DO NOT share it with anyone outside Check Point.
High CPU consumption on a ClusterXL Standby member
Technical Level
Solution ID
sk156333
Technical Level
Product
ClusterXL, Cluster - 3rd party, CoreXL
Version
R77.30, R80.10, R80.20, R80.30
OS
Gaia
Platform / Model
All
Date Created
20-Jun-2019
Last Modified
09-Feb-2020
Symptoms
fw_workers process consumes high CPU on the Standby member of a ClusterXL.
High number of entries on fw tables which are performing local sync. the tables which perform local sync can be seen using the following command (from Expert mode):
# fw tab | grep 'local sync' -B 1 | grep -v 'local sync' | awk 'NF {print $2}' | xargs -i fw tab -t {} -s
For example:
[Expert@GW-1:0]# fw tab | grep 'local sync' -B 1 | grep -v 'local sync' | awk 'NF {print $2}' | xargs -i fw tab -t {} -s
HOST NAME ID #VALS #PEAK #SLINKS
localhost gtp_apn_params 111 0 0 0
HOST NAME ID #VALS #PEAK #SLINKS
localhost dcerpc_maps 114 4822 4925 0
HOST NAME ID #VALS #PEAK #SLINKS
localhost dcerpc_rmaps 115 9363 9369 0
HOST NAME ID #VALS #PEAK #SLINKS
localhost dcerpc_fw_rulebase_data 116 32 70 0
HOST NAME ID #VALS #PEAK #SLINKS
localhost dcerpc_epm_requests 117 17315 25000 0
HOST NAME ID #VALS #PEAK #SLINKS
localhost dcerpc_udp_maps 119 0 0 0
HOST NAME ID #VALS #PEAK #SLINKS
localhost dcerpc_udp_rmaps 120 0 0 0
Cause
By default the 'local sync' interval mechanism of the Standby member is different from the 'local sync' interval mechanism on Active member. The interval on the Standby member is much lower which cause it to preform local sync more often.
