> Source: [sk97306](https://support.checkpoint.com/results/sk/sk97306)

# sk97306 - 'fw sam' command fails to process the SAM rule with "sam: Name_of_GW_Object ... failed 'Syntax of SAM rule' processing" error

| Property | Value |
|----------|-------|
| Solution ID | sk97306 |
| Date Created | 2013-11-21 |
| Last Modified | 2015-06-11 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |

## Symptoms

- * '`fw sam`' command fails to process the SAM rule with "`sam: `*Name_of_GW_Object*` (`*FW_Index* `/`*FW_Total* `) ... failed '`*Syntax of SAM rule*`' processing`" error.   

  *Example* :

  ```
  
  [Expert@MGMT]# fw sam -v -s 192.168.10.20 -f Main_Cluster -t 7200 -J src 1.1.1.1
  sam: request for 'Inhibit Drop Close src ip 1.1.1.1 on Main_Cluster' acknowledged
  sam: Member_A (0/2) failed 'Inhibit Drop Close src ip 1.1.1.1 on Main_Cluster' processing
  sam: Member_B (1/2) failed 'Inhibit Drop Close src ip 1.1.1.1 on Main_Cluster' processing
  sam: request for 'Inhibit Drop Close src ip 1.1.1.1 on Main_Cluster' done
  ```

* Policy installation, or restarting the Check Point services (`cpstop;cpstart`) do not help.  

* Debug of FWD daemon on Security Gateway per [sk86321](http://supportcontent.checkpoint.com/solutions?id=sk86321) shows:

  ```
  
  [FWD PID TID]@HostName[Date Time] get_sam_file_size: getting file size 
  [FWD PID TID]@HostName[Date Time] get_sam_file_size: file size is 5000016 bytes 
  [FWD PID TID]@HostName[Date Time] fw_sam_inhibit_conns: session=0x... file size exceeded. Will not add the request 
  [FWD PID TID]@HostName[Date Time] fw_sam_generate_log: session 0x...: Sending log Failed to add the following dynamic (SAM) rule: ...
  ```

## Cause

The size of the SAM records file on the Security Gateway / Cluster member(s) - `$FWDIR/log/sam.dat` - has exceeded a hard-coded limit of 5 MB.

The SAM records file contains all requests sent to the Security Gateway including obsolete requests. Purging these obsolete requests from the file decreases its size.

Background:

* The FWD module stores the Suspicious Activity Monitoring (SAM) rules received from the FWM module in the `$FWDIR/log/sam.dat` file in a binary format.
* SAM rules are pushed to the Check Point kernel when they are received, as well as after policy installation and as part of FWD module initialization (to ensure that they remain active after system restarts).
* Security Gateway acts as a SAM Server.
* Management Server acts as a SAM Client.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content