The Resource Advisor Daemon (RAD) is the core process for the URL Filtering and Application Control blades. When a user requests a URL, the Security Gateway first checks its local cache. If the URL is not in the cache, or if the cache limit has been exceeded causing frequent evictions, RAD must query the Check Point Online Web Service in the cloud. This cloud lookup is a significantly more resource-intensive operation than a local cache hit. When the cache limit is consistently exceeded under heavy traffic with many unique URLs, the gateway is forced to perform a large number of these cloud lookups, causing the RAD process's CPU utilization to spike, often reaching near 100 percent.

A. The URL Filtering blade is not disabled when the cache limit is reached, as this would create a significant security gap in the organization's policy enforcement.

B. Spawning multiple RAD processes is not the designed behavior for a full cache; this would likely exacerbate resource contention rather than resolve the issue.

D. The Security Gateway does not dynamically raise the cache limit indefinitely. The cache has a configurable, but fixed, memory allocation to prevent uncontrolled memory consumption and maintain system stability.

1. Check Point SecureKnowledge (SK) Article sk109676: "RAD process consumes high CPU on Security Gateway with enabled URL Filtering blade".

Symptom Section: "RAD process on Security Gateway with enabled URL Filtering blade consumes close to 100% of one CPU core."

Cause Section: "When the URL Filtering cache limit is reached, every new URL request that is not in the cache requires a query to the Check Point Online Web Service. This causes the RAD process to consume high CPU."

2. Check Point SecureKnowledge (SK) Article sk112153: "URL Filtering cache memory allocation".

Solution Section: This article details the kernel parameters for managing the URLF cache size (e.g., radurlfcachesize). It explains that there is a defined limit and describes the mechanism: "When the cache limit is reached, the oldest entries are replaced with new ones (LRU - Least Recently Used algorithm)." This confirms the cache has a fixed limit and does not grow dynamically (contradicting option D).

3. Check Point R81.1 Security Gateway Administration Guide:

Chapter: Monitoring Gateway Performance > CoreXL and Performance Tuning. While not directly stating the cache limit issue, this guide discusses how features like Application Control & URL Filtering are CPU intensive and require careful monitoring. It reinforces that processes like RAD are critical to performance and that resource exhaustion (like high CPU) is a key monitoring metric, which aligns with the problem described.