> Source: [sk150812](https://support.checkpoint.com/results/sk/sk150812)

# sk150812 - High CPU when traffic is dropped by fw_workers

| Property | Value |
|----------|-------|
| Solution ID | sk150812 |
| Date Created | 2019-04-29 |
| Last Modified | 2021-12-16 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |
| OS | Gaia |

## Symptoms

- * High CPU is observed when there is a high amount of dropped packets by fw_workers.
* Although "drop templates" feature is enabled (as per [sk90861](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk90861)), users still see the dropped traffic handled by fw_workers.
* The output of `fwaccel stats -d` (to show the statistics of drops by SecureXL), does not show any increase of the drop templates section.

  ```
  
  Example:
  [Expert@Hostname:0]# fwaccel stats -d
  Reason                Value              Reason                Value
  --------------------  ---------------    --------------------  ---------------
  general reason                  13478    CPASXL decision                     0
  PSLXL decision                      0    clr pkt on vpn                      0
  encrypt failed                      0    drop template                       0
  decrypt failed                      0    interface down                      0
  cluster error                       0    XMT error                           0
  anti spoofing                    1901    local spoofing                      0
  sanity error                        0    monitored spoofed                   0
  QOS decision                        0    C2S violation                       0
  S2C violation                       0    Loop prevention                     0
  DOS Fragments                       0    DOS IP Options                      0
  DOS Blacklists                      0    DOS Penalty Box                     0
  DOS Rate Limiting                   0    Syn Attack                          0
  Reorder                             0    Expired Fragments                   0
  ```

## Cause

A lock in the code is preventing from drop templates to work correctly, as a result, the FW keeps offloading the dropped connections to SecureXL.

The CPU processing required for the instances (both for dropping traffic and offloading to SXL), resulting with high load over the CoreXL instances (relevant also to VSX).

## Solution

This problem was fixed. The fix is included starting from:

* [Check Point R80.20](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk122485)

Check Point recommends to always upgrade to the most recent version   
([upgrade Security Gateway](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=overview&product=435) / [upgrade Security Management Server](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=overview&product=184) / [upgrade Multi-Domain Security Management](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=overview&product=166)).

<br />

If you choose not to upgrade, Check Point can supply a **Hotfix** . [Contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for this issue.  
A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.  
For faster resolution and verification, please collect [CPinfo files](http://supportcontent.checkpoint.com/solutions?id=sk92739) from the Security Management Server and Security Gateways involved in the case.

**Hotfix installation instructions:**   
Refer to [sk168597 - How to install a Hotfix](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk168597).

<br />

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content