Looks like someone is trying to do something *evil* at your network :-0

CPMAD stands for Check Point Malicious Activity Detection and does what it's fancy 
title says but in not that fancy a way ;-). There
is a documented memory leak in CPMAD.exe as far as I know and unfortunately there are 
only a few things you can do. First off, you
need at least 1GB - 2GB of RAM in order for the Server to breath. You'll also need to 
edit the file cpmad_config.conf and change the
MAD_memory parameter to a value you'd like (I've got mine at 150000Kb). You should 
then stop and start the firewall-1 service and
push the policy for the changes to take effect. You could also *disable* CPMAD by 
editing the aforementioned file and changing the
parameter MAD_system_mode from *on* (apparently) to *off*, even though I do not 
suggest you done so (even if CPMAD is trivial, at
least you can get some kind of events in your Log Viewer).

Hope these help.

Cheers,

Dimitris

-----Original Message-----
From: Mailing list for discussion of Firewall-1 [mailto:[EMAIL PROTECTED] On Behalf Of 
Lopez Zambrano,
David
Sent: Tuesday, June 29, 2004 10:46 AM
To: [EMAIL PROTECTED]
Subject: [FW-1] Problem with cpmad.exe


Hi all,

i have a little problem with an exec called cpmad.exe... it grows to fill all memory 
available, and at last, the system crash, if i
stop the fw-service the memory frees, of course...

The system is an 'old' FW1 4.1sp1 over NT, with 2 boxes, this exec grows only on the 
primary node, the one who store the logs.
Also, since a month ago, when the schedule task to switch the log runs, always got an 
error that tells me that the log can't be
switched, but it finally switchs the log, why 'fw logswitch' ends with that error? if 
finally works ?


Greetings

David Lopez
anuntis.com

=================================================
To set vacation, Out-Of-Office, or away messages,
send an email to [EMAIL PROTECTED]
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
[EMAIL PROTECTED]
=================================================

=================================================
To set vacation, Out-Of-Office, or away messages,
send an email to [EMAIL PROTECTED]
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
[EMAIL PROTECTED]
=================================================

Reply via email to