> Source: [sk170307](https://support.checkpoint.com/results/sk/sk170307)

# sk170307 - "Failed to handle CP Site request" in Anti-Bot / Anti-Virus System Alert Logs

| Property | Value |
|----------|-------|
| Solution ID | sk170307 |
| Date Created | 2020-11-20 |
| Last Modified | 2021-03-30 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R81 (EOS) |
| OS | Gaia |

## Symptoms

- * Anti-Bot / Anti-Virus System Alert Logs show "`Failed to handle CP Site request`".   
  ![](https://sc1.checkpoint.com/sc//SolutionsStatics/sk170307/ErrorLog202011061025171.png)
* The errors are for URLs that start with **/**. In the example log above, the URL is **/sdktunnel**.
* Errors from `/opt/CPsuite-R80.XX/fw1/log/rad_events/Errors/` logs:   
  `
  `  
  `[rad_http_request_comp_val64.cpp:28] CRadHttbrequestCompVal64::buildBase64: [INFO] enter to ... `  
  `
  `  
  `[rad_http_request_comp_val64.cpp:37] CRadHttbrequestCompVal64::buildBase64: [INFO] encode resource in base64 failed `  
  `
  `  
  `[rad_http_request_host_64.cpp:96] CRadHttbrequestHost64::build: [ERROR] buildBase64 failed for '' `  
  `
  `  
  `[rad_http_request.cpp:120] CRadHttbrequest::build: [ERROR] error building request `  
  `
  `  
  `[rad_query.cpp:171] CRadQuery::build: [ERROR] failed to build http request from values map `  
  `
  `  
  `[rad_query.cpp:171] CRadQuery::build: [ERROR] failed to build http request from values map `  
  `
  `  
  `[rad_trapper_fetcher.cpp:82] CRadTrapperFetcher::run: [ERROR] error while build message for service ' `  

  <br />

## Cause

URL's with **/** in front of the request should not have been sent to RAD.

<br />

## Solution

This problem was fixed. The fix is included in:

* [Check Point R81](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk166715)

Check Point recommends to always upgrade to the most recent version ([Anti-Bot](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=overview&product=429) / [Anti-Virus](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=overview&product=431)).

For **other [supported](http://www.checkpoint.com/support-services/support-life-cycle-policy/index.html) versions** , Check Point can supply a **Hotfix** . [Contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for this issue. A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix. For faster resolution and verification, please collect [CPinfo files](http://supportcontent.checkpoint.com/solutions?id=sk92739) from the Security Management Server and Security Gateways involved in the case.

To send the request that has the **/**in front of the URL request, enable the following kernel parameter (the default is 0):

    fw ctl set int malware_request_accept_extra_prefix_slash_in_url 1

You must add the kernel parameter to the file `$FWDIR/boot/modules/fwkern.conf` in order for the parameter to survive a reboot. In the file it should look like this:
`malware_request_accept_extra_prefix_slash_in_url=1`

If you have a cluster, set the kernel parameter on both members.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content