> Source: [sk182223](https://support.checkpoint.com/results/sk/sk182223)

# sk182223 - Security Gateways with a large number of CPU cores allocated to CoreXL SND may experience performance issues when the "fwaccel dos deny" feature is configured

| Property | Value |
|----------|-------|
| Solution ID | sk182223 |
| Date Created | 2024-04-19 |
| Last Modified | 2024-06-05 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R81.20, R81.10 (EOS), R81 (EOS) |
| OS | Gaia |

## Symptoms

- * Random traffic outage and latency followed by Security Gateway crash.

* No VMcore or process core dump files.

* CPview \> CPU \> Overview shows that most or all of the "`CoreXL_SND`" cores are utilized at around 100% (in the "`User`" column).

* CoreXL Dynamic Balancing is increasing the number of SND CPU cores, but it does not resolve the issue.

* Output of the "`perf top -C <SND CPU ID>`" command on the Security Gateway / Cluster Member during the traffic outage shows that the function responsible for the high CPU utilization is "`native_queued_spin_lock_slowpath`".

## Cause

System with a large number of CPU cores allocated to CoreXL SND may experience performance issues when an IoC Feed and the "`fwaccel dos deny`" feature are configured.

To confirm the issue, **both** of these conditions must be true:

1. Output of the "`perf top -C <SND CPU ID>`" command on the Security Gateway / Cluster Member during the traffic outage shows that the function responsible for the high CPU utilization is "**native_queued_spin_lock_slowpath**".

   ![](https://sc1.checkpoint.com/sc/SolutionsStatics/NEW_SK_NOID1713448767617/perf202404181718252.png)
2. The function "**dos_db_read_lock_deny_list**" appears in the perf report after running these commands in the Expert mode, while the SND CPU cores are highly utilized:

   1. `perf record -g -C <CPU_Number> sleep 20`
   2. `perf report -g flat -sw > /var/log/perf_report.txt`
   3. `cat perf_report.txt`

   ![](https://sc1.checkpoint.com/sc/SolutionsStatics/NEW_SK_NOID1713448767617/SND202404181715281.png)

## Solution

This problem was fixed. The fix is included starting from:

* [](https://support.checkpoint.com/results/sk/skXXX)[Jumbo Hotfix Accumulator for R81.20](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.20/Default.htm) starting from Take 54
* [Jumbo Hotfix Accumulator for R81.10](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.10/Default.htm) starting from Take 141
* [Jumbo Hotfix Accumulator for R81](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81/Default.htm) starting from Take 99
* [Jumbo Hotfix Accumulator for R80.40](https://sc1.checkpoint.com/documents/Jumbo_HFA/R80.40/Default.htm) starting from Take 211

Check Point recommends to always upgrade to the [Recommended version](https://support.checkpoint.com/results/sk/sk95746) ([Security Gateway](https://support.checkpoint.com/product/73) / [VSX](https://support.checkpoint.com/product/359)).

If you choose not to upgrade, [contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for your version.

A Support Engineer will make sure the Hotfix is compatible with your environment before providing it.  
For faster resolution and verification, collect [CPinfo](https://support.checkpoint.com/results/sk/sk92739) files from the Management Server and Security Gateways / Cluster Members involved in the case.

**Hotfix installation instructions:**   
Refer to [sk168597 - How to install a Hotfix](https://support.checkpoint.com/results/sk/sk168597).

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content