Re: [FW-1] Possible memory leak in NG with Solaris 8

[Jean-Francois Gobin <gobin@FW1-NOSPAMGOBINJF.BE>]

Hello Flavio,

First, You have also to apply the latest cluster patches (I guess it's
something like HFA315 by now). They correct a number of issues.

May you do again the test and let the computer reach the "no mem" point. I
want in fact to know if the memory is really lost or simply put aside "for
future usage". You know, it's possible that checkpoint just ask memory to
OS when its own memory pool is near exhaustion and never returns it to OS
but instead add it to its pool.

If there is a memory leak, with a continuous high flow, the computer will
at a moment start to paginate and then crash. If it just keeps asking for
mem block it should start "garbage collect" its pool.

JF

On Mon, 14 Jul 2003, Flavio Machado wrote:

> We have changed FW-1 to NG (FP3 in 1 machine and AI in other) and we are
> experimenting a problem related to continuous lose of memory.
>
> When started and without any connections applied, the memory remains
> constant. When we send a increasingly number of connections to it, it starts
> "bleeding" memory, effectively spending from 8K to 24K per 2 seconds (by
> vmstat). We thought it was ok to consume memory when submitted to a high
> flow of connections but when the high flux stopped, system memory still
> continued to bleed and never got released.
>
> We were doing a stress test before production and waited more than 10
> minutes after the conclusion of test and no memory was returned to the
> system. We did a cpstop and still no memory released (in FP3, NG-AI
> apparently released it with cpstop, but reallocated it all with cpstart).
> Only solution was a reboot. The stress test gone up to 78000 connections,
> but our production firewall has already gone up to 140000.
>
> We cannot agree to this "Microsoft like" solution. Reboot is not an option
> in some situations.
>
> For the record, we are using Solaris 8 64-bit release 02/02, Core
> installation, with 8_Recommended patched (latest, July 2003) applied;
> Firewall-1 NG-FP3 with HF2; Firewall-1 NG-AI
>
> We ran the tests on 2 machines: E450, 512 MB RAM, 2 sparc processors; Sun
> Fire V880, 4 processors, 4 GB RAM. The two machines presented the same
> behavior with the two versions of FW-1.
>
> Anyone having the same problem? There is a solution to it? FW-1 works with
> Solaris 9? If yes, is it better than Solaris 8?
>
> Thanks in advance for any light on the subject.
>
> Flavio Tulio C. S. Machado
>
> .
>
> =================================================
> To set vacation, Out-Of-Office, or away messages,
> send an email to LISTSERV@amadeus.us.checkpoint.com
> in the BODY of the email add:
> set fw-1-mailinglist nomail
> =================================================
> To unsubscribe from this mailing list,
> please see the instructions at
> http://www.checkpoint.com/services/mailing.html
> =================================================
> If you have any questions on how to change your
> subscription options, email
> fw-1-owner@ts.checkpoint.com
> =================================================
>

--
Jean-Francois Gobin - Administrateur gobinjf.be
http://www.gobinjf.be   mailto:gobin@gobinjf.be

=================================================
To set vacation, Out-Of-Office, or away messages,
send an email to LISTSERV@amadeus.us.checkpoint.com
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
fw-1-owner@ts.checkpoint.com
=================================================