> Source: [sk113736](https://support.checkpoint.com/results/sk/sk113736)

# sk113736 - "fwd" process or "fw_full" process on Security Gateway consumes memory at high level and crashes with core dump file

| Property | Value |
|----------|-------|
| Solution ID | sk113736 |
| Date Created | 2016-10-05 |
| Last Modified | 2022-06-29 |
| Technical Level | General |
| Products | Security Gateway, Security Management Server, Multi-Domain Security Management Server |
| Versions | R82.10, R82, R81.20, R82.20 |

## Symptoms

- * Output of `ps auxw | grep -E "fwd|fw_full"` command on Security Gateway shows that *fwd* process or *fw_full* process consumes memory at high level - memory consumption constantly rises and reaches 2 GB.

* After enabling generation of core dump files per [sk92764](http://supportcontent.checkpoint.com/solutions?id=sk92764) / [sk53363](http://supportcontent.checkpoint.com/solutions?id=sk53363), core dump files for '*FWD* ' process or '*FW_FULL* ' process were generated in the */var/log/dump/usermode/* directory.

## Cause

Memory leak in FWD daemon on Security Gateway related to CPMICache.

## Solution

This problem was fixed. The fix is included in:

* [Check Point R80.10](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk111841)
* [Jumbo Hotfix Accumulator for R77.30](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk106162) - since *Take_206*

For **other [supported](http://www.checkpoint.com/support-services/support-life-cycle-policy/index.html) versions** , [Check Point Support](http://www.checkpoint.com/support-services/contact-support/index.html) can supply a **Hotfix** .  
A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.  
For faster resolution and verification, please collect [CPInfo files](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92739) from the Security Management Server and Security Gateways involved in the case.

**Hotfix installation instructions:**

1. Hotfix has to be installed on ***both Security Gateway AND Management Server***.

   **Note:** In cluster environment, this procedure must be performed on *all* members of the cluster.   
   **Note:** In Management HA environment, this procedure must be performed on *both* Management Servers.
2. Procedure:

   * Using CPUSE:

     Make sure to install the [latest build of the CPUSE Agent](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92449#Latest build of CPUSE and What's New).

     Refer to [sk92449: CPUSE - Gaia Software Updates (including Gaia Software Updates Agent)](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92449#How to work with CPUSE):
     * Section "[(4-A-c)](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92449#How to work with CPUSE - How to download and import a CPUSE package - Import instructions for Offline procedure - Gaia Portal)" / "[(4-A-d)](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92449#How to work with CPUSE - How to download and import a CPUSE package - Import instructions for Offline procedure - Gaia Clish)" - refer to import instructions for *Offline procedure*
     * Section "[(4-B-a)](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92449#How to work with CPUSE - How to install a CPUSE package - Installing a Hotfix package / Minor Version package)" - refer to installation instructions for *Hotfixes*

     **Note:** Reboot is required.
   * Using Legacy CLI:

     Note: On these versions of VSX, the Gaia CPUSE does not support installation of hotfixes (refer to [sk92449](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92449#System requirements and limitations) - section "(2)" - "VSX Gateways").
     1. Transfer the hotfix package to the machine (into some directory, e.g., */some_path_to_fix/*).

     2. Unpack and install the hotfix package:

        ***\[Expert@HostName\]# cd /some_path_to_fix/***   
        ***\[Expert@HostName\]# tar -zxvf fw1_wrapper_\<HOTFIX_NAME\>.tgz***   
        ***\[Expert@HostName\]# ./fw1_wrapper_\<HOTFIX_NAME\>***
        **Note:** The script will stop all of Check Point services (*cpstop*) - read the output on the screen.
     3. Reboot the machine.

**Related solutions:**

* [sk117655 - "fwd" process or "fw_full" process on Security Gateway consumes memory at high level after installing Take 206 of R77.30 Jumbo Hotfix Accumulator](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk117655)

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content