> Source: [sk104579](https://support.checkpoint.com/results/sk/sk104579)

# sk104579 - 'clish' and 'confd' processes consume CPU at high level after SSH session for non-local TACACS user has been expired/killed

| Property | Value |
|----------|-------|
| Solution ID | sk104579 |
| Date Created | 2015-02-05 |
| Last Modified | 2018-06-24 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |
| OS | Gaia |

## Symptoms

- * 'clish' and 'confd' processes consume CPU at high level after SSH session for non-local TACACS user has been expired/killed.

* Running *strace* (provided by Check Point Support) on *clish* process of expired non-local user session shows:

  ```
  
  socket(PF_UNIX, SOCK_STREAM, 0) = 13
  setsockopt(13, SOL_SOCKET, SO_SNDBUF, [65536], 4) = 0
  setsockopt(13, SOL_SOCKET, SO_RCVBUF, [65536], 4) = 0
  connect(13, {sin_family=AF_UNIX, path="/tmp/xgets"}, 13) = 0
  write(13, "\1\3\0\0\0:\0\0\0\0\0\0\1\0\0\7USERNAME\0\0\0\0volat"..., 70) = 70
  select(1024, [13], NULL, NULL, {10, 0}) = 1 (in [13], left {9, 999000})
  read(13, "\2\3\0\0\0\0\0\0\0\0\0\0", 12) = 12
  close(13) = 0
  unlink(umovestr: Input/output error 0x2) = -1 EFAULT (Bad address)
  uname({sys="Linux", node="HOSTNAME", ...}) = 0
  getuid32() = 0
  ```

* Multiple Clish process running consuming high cpu

## Cause

'clish' keeps running the session for expired TACACS non-local SSH session.

'clish' does not delete socket bindings after TACACS non-local SSH session has been expired.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content