> Source: [sk183587](https://support.checkpoint.com/results/sk/sk183587)

# sk183587 - During a scheduled Gaia OS snapshot or backup, high CPU utilization may cause stability issues in ClusterXL and IPS Bypass

| Property | Value |
|----------|-------|
| Solution ID | sk183587 |
| Date Created | 2025-06-19 |
| Last Modified | 2025-07-14 |
| Technical Level | General |
| Products | Security Gateway, Scalable Platforms |
| Versions | R82, R81.20, R81.10 (EOS), R82, R81.20, R81.10 (EOS) |
| OS | Gaia |

## Symptoms

- * During a scheduled Gaia OS snapshot or backup, high CPU utilization may cause these issues:

  * In ClusterXL, the cluster state of cluster members may change from STANDBY to DOWN
  * In Scalable Security Group, the cluster state of Security Group Members may change from ACTIVE to DOWN
  * IPS Bypass may be triggered
* Output of the "`top`" / "`ps`" commands during the issue shows that the "`pigz`" process consumes CPU at high level.

## Cause

The Gaia OS uses the "pigz" utility for data compression. This utility prioritizes speed over stability.

If the current CPU load on the Security Gateway / Cluster Members / Security Group is already high, then collecting a Gaia OS snapshot or backup may increase the CPU load to the level, at which it is not possible to guarantee stable operation.

## Solution

**Best Practice** - We recommend scheduling the Gaia OS backup and snapshot operations during the times of the least CPU load on the Security Gateway / Cluster Members / Security Group (for example, during the night).

[Contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for this issue (requires manual configuration).

A Support Engineer will make sure the Hotfix is compatible with your environment before providing it.  
For faster resolution and verification, collect these files:

1. [CPinfo](https://support.checkpoint.com/results/sk/sk92739) file from the Management Server involved in the case.
2. [CPinfo](https://support.checkpoint.com/results/sk/sk92739) file from the Security Gateway / each Cluster Member / Security Group involved in the case.

**Hotfix installation instructions:**

1. Follow [sk168597 - How to install a Hotfix](https://support.checkpoint.com/results/sk/sk168597) to install the hotfix and reboot.
2. With this hotfix installed, by default, the Gaia OS will use the "`gzip`" utility (that prioritizes stability) to compress the collected snapshot / backup data.  
   If it is necessary to prioritize speed during the snapshot / backup compression, then you can configure the Gaia OS to use the "`pigz`" utility:
   1. Connect to the command line on the Security Gateway / each Cluster Member / Scalable Platform Security Group.
   2. If the default shell is Gaia Clish / Gaia gClish, then go to the Expert mode:  
      `expert`
   3. Create the relevant file:
      1. On the Security Gateway / each Cluster Member:  
         `touch /etc/use_pigz`
      2. On the Scalable Platform Security Group:  
         `g_all touch /etc/use_pigz`

   Note: To configure the Gaia OS to use the "`gzip`" utility again:
   1. Connect to the command line on the Security Gateway / each Cluster Member / Scalable Platform Security Group.
   2. If the default shell is Gaia Clish / Gaia gClish, then go to the Expert mode:  
      `expert`
   3. Delete the relevant file:
      1. On the Security Gateway / each Cluster Member:  
         `rm -f /etc/use_pigz`
      2. On the Scalable Platform Security Group:  
         `g_all rm -f /etc/use_pigz`

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content