Are you aware of any scenario where the number of active cores can change during runtime?
One of the issues that indeni checks is that all cluster memebers running CoreXL are configured with the same number cores. The rule uses the output of the "fw ctl multik stat" command, counts the number of Active cores (identified as "Yes") and compares the number between the cluster members. According to the Check Point documentation, a change to the number of Active cores can only be put into effect by booting the device.
Recently we have noticed that the number of Active cores, reported by the command. can drop on one of the cluster members for a period of 30 to 60 minutes and than reverts to the previous value.