High CPU, Strange alerts problem

[ggts2008]

Hi All,

I have Check Point UTM 270 (Total Security) running in cluster - Active/Standby mode.

I have few issues as follows:

1. Smart monitor shows alerts - Please see attached, both SRC and DST does not belong to my network.
2. tcpdump does not show none of these IPs in any interface.
3. During this time, high CPU usage is seen.
4. Only 6 active connections/sec at this time.
5. "top" in the cli shows in.ahttpd uses the most.

Can anybody please let me know what causes this problem and how to solve this?

Thanks in advance.

[melipla]

Those alerts are generated by the URL filtering. Its odd that you claim neither the source nor the destination are on your network--I don't know how you would see those alerts then. Can you trigger legitimate alerts by surfing to those websites? Do those alerts have the correct source / destination?

You could try to disabling smartdefense for the site & see if that improves performance. However even with SMDF enabled you shouldn't have that poor of a performance if you only have 6 connections & minimal bandwidth utilization. If you want to keep it enabled, I would ask if you've updated smartdefense recently?