> Source: [sk184456](https://support.checkpoint.com/results/sk/sk184456)

# sk184456 - The syslog traffic is dropped with error: "dropped by fw_spii_execute_inspections Reason: spii inspection matrix drop"

| Property | Value |
|----------|-------|
| Solution ID | sk184456 |
| Date Created | 2025-12-23 |
| Last Modified | 2025-12-30 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |
| OS | Gaia |

## Symptoms

- * The Check Point Security Gateway drops syslog traffic sent by a third-party firewall to the syslog server.

* `fw ctl zdebug drop` kernel debug shows this output:  
  "*dropped by fw_spii_execute_inspections Reason: spii inspection matrix drop"*.

* Adding exception rules to prevent the drop does not resolve the issue. No logs appear in SmartConsole for the dropped connections.

* Setting the IPS protection **Syslog Message Length Enforcement** to Detect or Inactive does not resolve the issue.

* Output of the `tcpdump` command shows the traffic, but the traffic does not pass through the Security Gateway.

## Cause

The third-party firewall sends the syslog messages with a UTF-8 Byte Order Mark (BOM) (hexadecimal: EF BB BF) at the beginning of the payload. The Streaming Passive Inspection Infrastructure (SPII) engine parses the packet at a lower inspection layer than the Intrusion Prevention System (IPS) policy logic. When the SPII parser encounters the BOM, it treats the message as malformed and drops the packet before any IPS Detect or Prevent decision is applied.   
This behavior is a security measure to prevent possible corruption or evasion and is not affected by IPS protection settings or exception rules.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content