> Source: [sk1000069](https://support.checkpoint.com/results/sk/sk1000069)

# sk1000069 - VSX Gateway Stops Processing Traffic After Sequential Reboots in a Maestro Security Group

| Property | Value |
|----------|-------|
| Solution ID | sk1000069 |
| Date Created | 2026-08-26 |
| Last Modified | 2026-09-11 |
| Technical Level | General |
| Products | Scalable Platforms |
| Versions | R81.20 |
| OS | Gaia |

## Symptoms

- After sequential reboots of all Security Group Members (SGMs) in a Maestro Security Group:

* The last rebooted Security Group Member (SGM) appears as DOWN in cluster status output.
* The active Critical Process Note (PNOTE) is `pull_config`.
* Running the following commands on a Maestro SGM shows the affected member as DOWN:
  * `cphaprob stat`
  * `asg monitor -v`
* The first rebooted SGM appears as UP for the affected VSX gateway but cannot execute most VSX or Maestro-related commands, including:
  * asg
  * cpstat
* Other VSX gateways continue to operate normally.
* Restarting services on the affected VSX gateway does not resolve the issue.
* Reboot requests issued from the affected context are not accepted.
* The /var/log/messages file on the affected SGM repeatedly reports:  
  `kernel:[SIM4];sim_cphwd_stats_cb: failed to create cpaq buffer`

## Cause

A hardware-acceleration statistics channel on a Maestro Security Group Member enters an unrecoverable state after the reboot sequence.

As a result, a process retains a Virtual System context database mutex and prevents normal VSX context operations. This condition can cause:

* Command execution failures
* pull_config PNOTE status
* Cluster state inconsistencies
* Traffic-processing interruption on the affected VSX gateway

## Solution

Permanent Solution
------------------


[Contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for this issue.

A Support Engineer will make sure the Hotfix is compatible with your environment before providing it.  
For faster resolution and verification, collect these files:

1. [CPinfo](https://support.checkpoint.com/results/sk/sk92739) file from the Management Server involved in the case.
2. [CPinfo](https://support.checkpoint.com/results/sk/sk92739) file from the Check Point Firewall / each Cluster Member / Security Group involved in the case.

**Hotfix installation instructions:**   
Refer to [sk168597 - How to install a Hotfix](https://support.checkpoint.com/results/sk/sk168597).

<br />

<br />

Temporary Solution
------------------

If the Hotfix cannot be installed immediately, use the following workaround.

### Step 1 - Identify the affected VSX gateway\>

Run on the affected Maestro Security Group Member (SGM) in Expert mode:`vsx stat -v`

Identify the VSX gateway that is not functioning correctly.

### Step 2 - Identify the mutex-holding process

Run on the affected Maestro Security Group Member (SGM) in Expert mode:`cat /proc/locks`

Identify the PID associated with the lock.

Review the process details:  
`ls -l /proc/<pid>/fd`  
`ps -fp <pid>`

Confirm that the process is holding the affected mutex before proceeding.

### Step 3 - Reboot the affected SGM

Before rebooting:

* Verify that cluster redundancy is available.
* Verify that the remaining Security Group Members are healthy.
* Follow approved maintenance procedures when required.

Run on the affected Maestro Security Group Member (SGM):`reboot`

The reboot releases the locked mutex and allows the affected VSX gateway to initialize again.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content