> Source: [sk184956](https://support.checkpoint.com/results/sk/sk184956)

# sk184956 - High load factor warning for Anti-Virus cache table in the Health Check Point Report

| Property | Value |
|----------|-------|
| Solution ID | sk184956 |
| Date Created | 2026-06-15 |
| Last Modified | 2026-06-18 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82, R81.20 |

## Symptoms

- * After upgrading a Security Cluster running Gaia 3.10 hosted on VMware vCenter from R82.10 to R82, and running `hcp -r all` in the Health Check Point (HCP) tool, HCP reported a high load factor for the `av_ldb_tbl` Firewall kernel table (Anti-Virus cache table).

* On each Security Gateway, running this command in Expert mode:  


  `fw tab -t av_ldb_tbl -s`  

  showed that:   

  * Load factor (average chain length / #SLINKS): Approximately 18.3 (which is above recommended threshold of 15).
  * Number of entries (#VALS): Approximately 600,000.

  Example (sanitized) output:
  `localhost> $FWDIR/bin/fw tab -t av_ldb_tbl -s`  
  `
  HOST NAME ID #VALS #PEAK #SLINKS`  
  `
  localhost av_ldb_tbl 0x12345678 599850 601234 18.3`

  <br />

* Clearing the Anti-Virus cache once (according to [sk105179 - How to clear Anti-Virus and Anti-Bot kernel cache](https://support.checkpoint.com/results/sk/sk105179) temporarily reduced the table size to zero, but after normal traffic resumed:  


  * The `av_ldb_tbl` increased again to approximately 600,000 entries.
  * The load factor increased again to approximately 18.
  * HCP continued to flag the load factor in Firewall tables warning.

  <br />

* No clear end-user performance or latency problems were reported. The HCP identified the issue proactively.

## Cause

The `av_ldb_tbl` kernel table stores Anti-Virus cache entries.  
The cache uses a hash table:

* `cache_max_hash_size` defines the maximum number of hash buckets
* `#VALS` = number of entries
* `#SLINKS` = average entries per bucket (load factor)

When:  
Number of entries \> hash size   
The result is:

* Multiple entries map to the same bucket (collisions)
* Load factor increases
* Lookup efficiency decreases

HCP flags high load factor as a potential performance risk. Note - HCP uses heuristic thresholds and flags values above \~15 as a warning indicator.

The issue occurs because:

* Cache size is too small for traffic volume
* Cache fills to steady-state (\~600K entries)
* Load factor increases again after clearing

The cache was not corrupted or stuck.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content