> Source: [sk183746](https://support.checkpoint.com/results/sk/sk183746) # sk183746 - High CPU utilization, accompanied by soft lockups on multiple CPU cores and a cluster failover due to lost CCP packets | Property | Value | |----------|-------| | Solution ID | sk183746 | | Date Created | 2025-08-07 | | Last Modified | 2025-08-20 | | Technical Level | General | | Products | Security Gateway | | Versions | R82, R81.20, R81.10 (EOS) | | OS | Gaia | ## Symptoms - * High CPU utilization on the Firewall with a CPU spike and temporary interface downtime, accompanied by soft lockups on multiple CPU cores and a cluster failover due to lost CCP packets * CPU spike logs show only a 5% increase for a single process during the incident. * The **Drops** tab in CPView (advanced mode) shows a constant high number of Rule Base drops. * The output of `fw ctl zdebug + drop` shows multiple drops triggered by the cleanup rule. Although `drop templates` is enabled, a dedicated template is not generated. ## Cause The file `/var/log/thread_blocker_device64.log` contains entries showing that threads on the Security Gateway are blocked. The entries indicate that the Firewall spends excessive time processing the Rule Base (security policy), which is causing performance issues**.** The Firewall receives a large volume of UDP packets that do not match any security rule and which the clean up rule drops. Although drop templates is enabled to optimize repeated drops, the system cannot generate a reusable template because the UDP flood continuously creates new connections. As a result, each packet is evaluated against the entire Rule Base, which significantly increases CPU load and causes soft lockups. ## Solution [Contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for this issue. A Support Engineer will make sure the Hotfix is compatible with your environment before providing it. For faster resolution and verification, collect these files: 1. [CPinfo](https://support.checkpoint.com/results/sk/sk92739) file from the Management Server involved in the case. 2. [CPinfo](https://support.checkpoint.com/results/sk/sk92739) file from the Security Gateway / each Cluster Member / Security Group involved in the case. **Hotfix installation instructions:** Refer to [sk168597 - How to install a Hotfix](https://support.checkpoint.com/results/sk/sk168597). After you install the Hotfix, enable the `activate_optimize_drops_support_now` parameter to optimize the drop templates feature. You can control the Security Gateway behavior with the kernel parameter **activate_optimize_drops_support_now**: |-------------------------------------------|--------------------------------| | Kernel Parameter Value | Security Gateway Behavior | | `activate_optimize_drops_support_now = 0` | Feature is disabled | | `activate_optimize_drops_support_now = 1` | Optimized drop template is on. | ### Procedure You can **configure** the applicable value for this kernel parameter temporarily (in the current session only - does not survive reboot), or permanently (survives reboot). **Important** - In ClusterXL, you must configure all cluster members in the same way. |--------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Deployment | Temporary Configuration | Permanent Configuration | | Security Gateway, ClusterXL | In Gaia Clish, or in the Expert mode: `fw ctl set int activate_optimize_drops_support_now ` | In Gaia Clish, or in the Expert mode: `fw ctl set -f int activate_optimize_drops_support_now ` | | Security Group in ElasticXL, Security Group in Maestro, Security Group on Scalable Chassis | In Gaia gClish: `fw ctl set int activate_optimize_drops_support_now ` In the Expert mode: `g_fw ctl set int activate_optimize_drops_support_now ` | In Gaia gClish: `fw ctl set -f int activate_optimize_drops_support_now ` In the Expert mode: `g_update_conf_file $FWDIR/modules/fwkern.conf activate_optimize_drops_support_now=` | To **see** the current value of this kernel parameter, run: |--------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------| | Deployment | Command | | Security Gateway, ClusterXL | In Gaia Clish, or in the Expert mode: `fw ctl get int activate_optimize_drops_support_now` | | Security Group in ElasticXL, Security Group in Maestro, Security Group on Scalable Chassis | In Gaia gClish: `fw ctl get int activate_optimize_drops_support_now` In the Expert mode: `g_fw ctl get int activate_optimize_drops_support_now` | --- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content