[FW-1] RES: [FW-1] Possible memory leak in NG with Solaris 8

[Flavio Machado <flavio.c.machado@FW1-NOSPAMCAIXA.GOV.BR>]

We left it running for a while without interference, but it crashed
(freezes) each 3 or 4 days, approximatedly. So we reboot it in 2 or 3 days
or when memory reaches a low limit. We would really love to have it a 20 MG
free and running but sadly it's not the case.

Thanks for your attention,

Flavio Tulio C. S. Machado

-----Mensagem original-----
De: Damien Hart [mailto:damien.hart@CANBERRATIMES.COM.AU]
Enviada em: segunda-feira, 14 de julho de 2003 19:15
Para: FW-1-MAILINGLIST@AMADEUS.US.CHECKPOINT.COM
Assunto: Re: [FW-1] Possible memory leak in NG with Solaris 8


I saw what I thought was a memory leak in SecurePlatform too but when I
asked this list I was advised that it was Checkpoints dynamic use of memory.
When I started monitoring the memory usage with MRTG I would see the
available memory drop my 20-30 Meg a day on busy days, less on weekends, and
so when it got down to about 10 Meg free I got worried and rebooted it - not
wanting it to clag out on me.  I too noticed that a cpstop-cpstart had
almost no effect.  Then one day I decided to see what happened if I let it
go without rebooting, and it has been running like that since the first week
of April. It seems quite happy with between 5 and 20 Meg of memory free and
it does fluctuate within this range.

So I guess my point is that it may not be a problem at all if it is the same
thing we are talking about.

regards

Damo





> We have changed FW-1 to NG (FP3 in 1 machine and AI in other) and we are
> experimenting a problem related to continuous lose of memory.
>
> When started and without any connections applied, the memory remains
> constant. When we send a increasingly number of connections to it, it
starts
> "bleeding" memory, effectively spending from 8K to 24K per 2 seconds (by
> vmstat). We thought it was ok to consume memory when submitted to a high
> flow of connections but when the high flux stopped, system memory still
> continued to bleed and never got released.
>
> We were doing a stress test before production and waited more than 10
> minutes after the conclusion of test and no memory was returned to the
> system. We did a cpstop and still no memory released (in FP3, NG-AI
> apparently released it with cpstop, but reallocated it all with cpstart).
> Only solution was a reboot. The stress test gone up to 78000 connections,
> but our production firewall has already gone up to 140000.
>
> We cannot agree to this "Microsoft like" solution. Reboot is not an option
> in some situations.
>
> For the record, we are using Solaris 8 64-bit release 02/02, Core
> installation, with 8_Recommended patched (latest, July 2003) applied;
> Firewall-1 NG-FP3 with HF2; Firewall-1 NG-AI
>
> We ran the tests on 2 machines: E450, 512 MB RAM, 2 sparc processors; Sun
> Fire V880, 4 processors, 4 GB RAM. The two machines presented the same
> behavior with the two versions of FW-1.
>
> Anyone having the same problem? There is a solution to it? FW-1 works with
> Solaris 9? If yes, is it better than Solaris 8?
>
> Thanks in advance for any light on the subject.
>
> Flavio Tulio C. S. Machado
>
>
>

=================================================
To set vacation, Out-Of-Office, or away messages,
send an email to LISTSERV@amadeus.us.checkpoint.com
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
fw-1-owner@ts.checkpoint.com
=================================================
.

=================================================
To set vacation, Out-Of-Office, or away messages,
send an email to LISTSERV@amadeus.us.checkpoint.com
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
fw-1-owner@ts.checkpoint.com
=================================================