Too Many Discards on Ext. int after ClusterXL was upgraded to R65

[res002mg]

Any shade of light shed into Checkpoint darkness will be greatly appreciated.
After upgrading ClusterXL to R65 var/log/messages log is flooded with the following entries:
“kernel: fwhandle_get(fwbuf.c:884): Table kbufs - Invalid handle 6f8cec (bad pool)” and
“kernel: hi_kbufs_free_all: Error freeing kbuf 6f8cec at index 0 in table http_ics_pre_auth_cookies(289)”
Intermapper constantly complains about “too many discards” on external interface of the active cluster member. Cphttpd.elg log file is flooded with the following error:
“SvcSk_init_ex: unable to bind to port 12873, errno 98
init_server_ex: failed to initialize the service socket
cpHttpSvc_init_ex2: failed to initialize the service socket”
Seams like two are related, or may be not? Anyone experienced or experience similar.

[melipla]

They may be two seperate issues.

The first could be Smart Defense related. Have you updated your Smart Defense [and pushed policy] since you upgraded?

Otherwise try turning off Smart Defense and see if that affects errors being generated. Probably worth opening a ticket w/Check Point.

The second almost sounds like one of the Check Point daemons tried to start while it was still running. Is it a constant recurring message or does it only happen once? A reboot may help resolve it.

[res002mg]

Both messages are re-occuring. SD was updated 2 times after R65 upgrade. "ICS" part in the first message makes me think it is SSl NE with ICS issue. My CP-1 support vendor says it can be ignorred. I have porblem with ignoring it as it creates 5 'messages' files each day. Any suggestion what SD option to turn off?
Second error entered in cphttpd.elg file every 5 minutes. Netstat or top does not show anything running on port 12873. Gateways had been rebooted several times after upgrade.

[melipla]

I am seeing this error:

SvcSk_init_ex: unable to bind to port 12873, errno 98
init_server_ex: failed to initialize the service socket
cpHttpSvc_init_ex2: failed to initialize the service socket
[cphttpd 915 2002731936]@cpmodule[1 May 14:29:37] cphttpd: Thu May 1 14:29:37 2008

But I do not see the kbuf error, so they *have* to be separate. Too bad there's already something listening on 12873:

tcp 0 0 0.0.0.0:12873 0.0.0.0:* LISTEN

Which is associated with:

av_http_server -j -f /opt/CPsuite-R65/fw1/conf/av_http_server.conf

I'm guessing this is associated with the AV content inspection, which I did not think I had enabled. Perhaps its turning on because of some SmartDefense check?