> Source: [sk91343](https://support.checkpoint.com/results/sk/sk91343)

# sk91343 - FWD process consumes CPU/memory at high level on Multi-Domain Management Server when LEA clients are connected to it

| Property | Value |
|----------|-------|
| Solution ID | sk91343 |
| Date Created | 2013-01-14 |
| Last Modified | 2025-04-11 |
| Technical Level | General |
| Products | Security Management Server, Multi-Domain Security Management Server |
| Versions | R82.10, R82, R81.20, R82.10, R81.10 (EOS), R81 (EOS), R81 (EOS), R81.10 (EOS), R81.20, R82 |
| OS | Gaia |

## Symptoms

- * FWD process (Log Server) consumes CPU/memory at high level on Domain Management Server / Domain Log Server when LEA clients are connected to it.

* FWD process stops working producing with cores dump files on Domain level, and the size of the core dump files is \~2G, which indicates high usage of memory and failure to allocate more memory.

* LEA clients fail to connect to the FWD (LEA server) and the fwd.elg file contains these errors:  

  `opsec_new_auth_conn_to_server: conn from <client IP> to entity lea_server (0x....) failed (0) No SIC error message`  
  `lea_server_session_start: too many session established already: 10. session will be rejected for this request.`

## Cause

FWD daemon might be busy with both writing the information to log file and forwarding this information to SmartEvent/SmartReporter or any other 3rd party LEA client (such as "Arcsight") via LEA session.

Each session requires high usage of memory. Therefore, multiple sessions cause FWD to run out of memory.

## Solution

**Follow these steps:**

1. Go to the context of relevant Domain Management Server / Domain Log Server:

   **`[Expert@HostName:0]# mdsenv <IP address of Name of Domain Management / Log Server>`**
2. Stop the relevant Domain Management Server / Domain Log Server:

   **`[Expert@HostName:0]# mdsstop_customer <IP address of Name of Domain Management / Log Server>`**
3. Spawn LEA sessions to separate process to run on different CPU cores:

   **`[Expert@HostName:0]# $CPDIR/bin/cpprod_util CPPROD_SetValue FW1//6.0 Spawn_LEA 4 1 1`**
4. Start the relevant Domain Management Server / Domain Log Server:

   **`[Expert@HostName:0]# mdsstart_customer <IP address of Name of Domain Management / Log Server>`**
5. After restarting a Domain Log Server, it is recommended to fetch the logs from the relevant Security Gateways.

   In SmartView Tracker, go to the ***Tools*** menu - click on the ***Remote Files Management*** - select the relevant Security Gateway - click on the ***Get File List...*** button.

**Notes:**

* To check the current version of **`Spawn_LEA`**, run:

  **`[Expert@HostName:0]# grep Spawn_LEA $CPDIR/registry/HKLM_registry.data`**
  * If `Spawn_LEA` is not found in Check Point registry, then it is not currently set
  * If output shows `:Spawn_LEA ("[4]1")`, then it was manually "enabled"
  * If output shows `:Spawn_LEA ("[4]0")`, then it was manually "disabled"
* On Security Management Server, spawning of LEA sessions is activated by default.

* To deactivate spawning of LEA sessions on relevant Domain, follow the above instructions, and in Step 3 run:

  **`[Expert@HostName:0]# $CPDIR/bin/cpprod_util CPPROD_SetValue FW1//6.0 Spawn_LEA 4 0 1`**

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content