> Source: [sk183655](https://support.checkpoint.com/results/sk/sk183655)

# sk183655 - High CPU consumption on the Security Gateway with the Application Control blade enabled

| Property | Value |
|----------|-------|
| Solution ID | sk183655 |
| Date Created | 2025-07-13 |
| Last Modified | 2025-07-15 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82, R81.20, R81.10 (EOS) |

## Symptoms

- * The Security Gateway with enabled Application Control blade starts to consume CPU more than usual. Rebooting does not help. Detailed Log / Extended Log is configured on a generic rule frequently matched by traffic, such as a cleanup rule.

  **Example:**   
  Source: Any  
  Destination: Any  
  Service: https  
  Action: accept  
  Log: Detailed
* CPU Spike Detective shows that the `up_clob_t_app_can_be_matched` function consumes the most of CPU.   
  Example Output:  

  ```
  # Overhead  Command          Shared Object                    Symbol
                                                                                                                                                                                               
  # 92.04%  fwk0_0           libfw_kern_64_us_optimized_0.so  [.] up_clob_t_app_can_be_matched.cold.0
  ```

## Cause

Enabling Detailed or Extended logs on generic rules (such as cleanup rules) causes excessive resource usage.

When these logging options are enabled, the Application Control engine attempts to identify and log application-level information for all matched traffic. This includes:

* **Detailed Log:** Shows the matched application, even if the rule does not explicitly reference any applications.
* **Extended Log:**Includes all data from the Detailed Log, along with a complete list of accessed URLs and files.
For each connection, the Security Gateway attempts to match applications by scanning the full Application Control database. This process adds substantial overhead, especially on generic rules that match a large volume of traffic.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content