> Source: [sk164452](https://support.checkpoint.com/results/sk/sk164452)

# sk164452 - In large Multi-Domain environments, FWM and global level log_indexer might crash in a loop

| Property | Value |
|----------|-------|
| Solution ID | sk164452 |
| Date Created | 2020-01-13 |
| Last Modified | 2025-04-25 |
| Technical Level | General |
| Products | Multi-Domain Security Management Server |
| Versions | R81 (EOS), R81.10 (EOS), R81.20 |
| OS | Gaia |

## Symptoms

- * FWM crashes due to its having reached the maximum memory of 4GB.
* log_indexer crashes due to its having reached the maximum memory of 4GB.

## Cause

The log_indexer process queries the FWM daemon for all the objects in the sem_tables. It keeps these objects in RAM in order to quickly resolve log data.

In a Multi-Domain machine, the Global level *log_indexer* will load all the data from all the domains.

In large environments, the process will run out of memory because it will try to load more than \~450,000 objects.

## Solution

The fix is included in these versions (requires additional configuration):

* [Check Point R81.10](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk170416)
* [Jumbo Hotfix Accumulator for R81](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk170114) starting from Take 51
* [Jumbo Hotfix Accumulator for R80.40](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk165456) starting from Take 100
* [Jumbo Hotfix Accumulator for R80.30](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk153152) starting from Take 232
* [Jumbo Hotfix Accumulator for R80.20](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk137592) starting from Take 190

If you choose not to upgrade, Check Point can supply a **Hotfix** . [Contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for this issue.  
A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.  
For faster resolution and verification, please collect [CPinfo files](http://supportcontent.checkpoint.com/solutions?id=sk92739) from the Security Management Server and Security Gateways involved in the case.

<br />

**Configuration Procedure:**

1. Connect to the command line on the Multi-Domain Server.
2. Log in to the Expert mode.
3. Go to the MDS context:  
   `mdsenv`
4. Edit the *$INDEXERDIR/log_indexer_custom_settings.conf* file:  
   `vi $INDEXERDIR/log_indexer_custom_settings.conf`
5. After this line:  
   `:dns_backresolving (true)`  
   Add this line:  
   `:enable_limited_resolving (true)`  
   When the value of this parameter is set to "true", the Global level log_indexer excludes the plain host from its query. This decreases the number of objects returned from the CPMI query.
6. Save the changes and exit Vi editor.
7. Restart the Indexer service:  
   `stopIndexer ; startIndexer`

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content