> Source: [sk178606](https://support.checkpoint.com/results/sk/sk178606)

# sk178606 - Security Gateway / VSX Virtual System with the Data Loss Prevention Software Blade enabled stops passing traffic because there are many open file descriptors for the DLPU process

| Property | Value |
|----------|-------|
| Solution ID | sk178606 |
| Date Created | 2022-04-19 |
| Last Modified | 2022-10-23 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R81.10 (EOS), R81 (EOS) |
| OS | Gaia |

## Symptoms

- * Security Gateway / VSX Virtual System with the Data Loss Prevention Software Blade enabled stops passing traffic.

* During the issue, output of this command shows at least several thousand:

  `lsof | grep dlp | wc -l`
* During the issue, output of this command shows at least several thousand:

  `lsof | grep dlp | grep deleted | wc -l`
* During the issue on a Security Gateway, output of this command:

  `lsof | grep dlp | grep deleted | head`

  shows many entries like this:

  `/var/log/opt/CPsuite-R<VERSION>/fw1/tmp/dlp/<Letters and Numbers>.metadata (deleted)`

  Example:

  `dlpu 3826 admin 29r REG 253,3 51 402887221 /var/log/opt/CPsuite-R80.40/fw1/tmp/dlp/4D25CC469250CA80343B9F945F48EAA17ABC421E.metadata (deleted)`
* During the issue on a VSX Gateway, output of this command:

  `lsof | grep dlp | grep deleted | head`

  shows many entries like this:

  `/var/log/opt/CPsuite-R<VERSION>/fw1/CTX/CTX<VSID>/tmp/dlp/<Letters and Numbers>.metadata (deleted)`

  Example:

  `dlpu 3826 admin 30r REG 253,3 51 402887221 /var/log/opt/CPsuite-R80.40/fw1/CTX/CTX00001/tmp/dlp/4D25CC469250CA80343B9F945F48EAA17ABC421E.metadata (deleted)`

## Cause

In a rare scenario, the DLP process leaves open unused file descriptors in the *$FWDIR/tmp/dlp* folder which may take up a large amount of disk space.  

can also happen when the blade is not enabled, because process dlpu is used by a lot of different blades.

## Solution

This problem was fixed. The fix is included starting from:

* [Jumbo Hotfix Accumulator for R81.10](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk175186&partition=Basic&product=All) starting from Take 55
* [Jumbo Hotfix Accumulator for R81](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk170114&partition=Basic&product=All) starting from Take 68
* [Jumbo Hotfix Accumulator for R80.40](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk165456&partition=Basic&product=All) starting from Take 158
* [Jumbo Hotfix Accumulator for R80.30](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk153152&partition=Basic&product=Endpoint) starting from Take 251
* [Jumbo Hotfix Accumulator for R80.20](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk137592&partition=General&product=All%22) starting from Take 208

Check Point recommends to always upgrade to the most recent version ([Security Gateway](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=downloads&product=435) / [VSX](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=downloads&product=359) / [Security Management Server](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=downloads&product=184) / [Multi-Domain Security Management Server](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=downloads&product=166) / [SmartConsole](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=downloads&product=191)).

<br />

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content