> Source: [sk80720](https://support.checkpoint.com/results/sk/sk80720)

# sk80720 - SmartEvent Performance Tuning Guide

| Property | Value |
|----------|-------|
| Solution ID | sk80720 |
| Date Created | 2012-07-29 |
| Last Modified | 2026-10-07 |
| Technical Level | General |
| Products | Security Management Server |
| Versions | R81.20, R81.10 (EOS), R81 (EOS) |

## Symptoms

- * SmartEvent UI is slow to respond to queries.
* Delay in seeing new events in SmartEvent (last 12h/24h queries return few or no new events).

## Solution

There are several tuning options available for maximizing your SmartEvent systems performance. The key points of this process:

1. Making sure your relevant event data is cached and fits in RAM.
2. Tuning the server to only work on your needs.
3. Using the latest code and patches available for performance.

**For Smart-1 appliances** - Before you begin, please read the information in the [Smart-1 Appliances page](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=overview&product=186), and make sure your device is properly sized for the scale of the data you generate.

**Improvements:**

1. **Version** -Make sure you upgrade your SmartEvent server to the latest version available.  
   **Also note that SmartEvent can be run in a newer version than your Security Management, if not running on the same H/W.**   

2. **RAM -** The first and most important factor in UI responsiveness is the amount of RAM available on your SmartEvent server. More RAM allows for caching more event data, reducing disk access time and significantly speeding up queries.  
   **Make sure you have 4GB for every 250K events generated per day.** For example: If you are generating 1M events daily, we recommend you use 16GB of RAM at least.  
   Note that for utilizing your extra RAM, it is recommended to run Gaia OS 64bit.

**Advanced Tuning:**

**IPS** - Tune your IPS logging by creating exceptions for false-positives, either in SmartDashboard or from the SmartEvent Events tab: Run the IPS -\> More -\> Exception / Exclusion Candidates query, and for each event group you wish to exclude, right-click and choose "Exclude from event Definition".

**Application Control / URL Filtering** - Tweaking the update interval for traffic updates on these events, can greatly increase the amount of traffic your SmartEvent server will be able to handle, at the cost of getting delayed traffic information (Byte updates). From the 'SmartEvent Policy tab -\> "Applications \& URL Filtering" -\> Application Activity -\> Properties -\> Count Logs -\> Advanced', change "Update Events Data After" from "0" to "3600". Save as a new event and disable the original one (updates on traffic information will now happen every hour instead of every 10 minutes). Repeat for "Web Browsing" event definition.

**Other Events** - Disable any events you do not require. In particular any under the "Anomalies" category, as they are resource intensive to generate.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content