Cisco Firewall :: High Cpu Utilization On Pix 515E?
Aug 9, 2012
I am facing high CPU util on my pix 515 E which is in failover mode.During peak hours the util is see rising to 60% where as in off peak hours it is normally12%.
During normal operation the average utilisation was observed to be 30% but suddenly from 2/3 days it is constantly 60% doule the value as earlier. Have gone through the logs and traffic but not able to tarce anything particular
below is the o/p of some command taken for analysis
IOS version 8.0(4)
sh cpu usage
CPU utilization for 5 seconds = 51%; 1 minute: 61%; 5 minutes: 58%
sh cpu usage
We had two PIXes in our environment and working as a active-failover mode. Its noted in now a days the active PIX memory utilization is 98% and for standby PIX it is 96%. And also in some times we were experiencing packet loss to the ip of active PIX and which reflects in the inside servers access also. During that time the active pix was not accessible via ssh as well as ASDM. We have tried reloading the PIX and changing failover state of the PIX, but it results only a temporary solution. Current memory installed is 128 MB (maximum upgraded), so a upgrade is also not possible. Please see the show command outputs from the PIX. Current Software version is 7.2(4)
sh memory output (PIX 1 - active) Free memory: 4850944 bytes ( 4%) Used memory: 129366784 bytes (96%)
[code]....
1) How we can pin point the root cause of this high memory utilization?
2) What might be the reason for the high memory utilization for the standby pix (96%), still the PIX is in idle state?
3) Is it a hardware issue or a memory leak issue, then how can we find out?
4) Is a software upgrade to new version resolves the memory issue?
I am facing high cpu util issue 80% in pix 515E with IOS 7.2(4).When a syslog is enable for informational/warnings level traps the util goes to 80% where as other wise it is observed to be 36-37%.When i changed the trap level to alert the util seems to be normal, only the issue is when warning and info traps are configured, prior to the issue the same settings were working absolutely fine ,suddendly the util issue has occured.
I have Active Standby ASA5550 setup with VPN premium license. A few days back we had a requirement of SSL VPN connection for and we got a temporary from Cisco for same, this license expired and the ASA reverted to it's original license. 3 4 days after this we saw a sudden increase in CPU utilization (upto 90% + -5%) on the ASA during production hours but were not able to figure out the reason, in order to restore the services we failovered the firewall to secondary and everything worked fine. We were suspecting one of the following but there were no logs for any of this
1. The ASA hardware was haivng problem
2. Some client was doing a DoS attack to bring down the ASA (no logs for this as well).
We took a downtime to look further by failovering the ASA back to primary and it worked fine without any issues ruling out the 1st option. We also came across a licesing doc [URL]
Downgrading any license (for example, going from 10 contexts to 2 contexts).
# Note If a temporary license expires, and the permanent license is a downgrade, then you do not need to immediately reload the security appliance; the next time you reload, the permanent license is restored.
As per this doc, sooner or later a restart was required on the ASA. We restarted secondary ASA and everthing was fine but when we restarted the primary ASA by swtiching over to secondary some of the server (not all) in the DMZ stopped working (even ICMP unreachable) and only came back to normal when the primary ASA was restored and working fine (with failover).
The reboot was done by shuting down the physical link between the Core switch and ASA inside individually.
I am not sure what could be the issue that the servers in the DMZ wen unreachable.
I have a remote site customer with a Cisco ASA 5540 running SSLVPN (Anyconnect)(8.03). It currently only serves about 450 SSLVPN clients. Since last friday, they've seen the CPU utilization go up to high 90% while only serving 400+ remote users. I saw some high cpu utilization bugs, but none looked to be relevant. How I can find the root cause of the CPU high utilization?
we have ASA 5520 with IOS 8.0 , when i am trying to add more static routes on the inside interface the CPU utilization is going up. one faced the same issue. I am configuring through the cisco ASDM 6.1(3)f.
Would like to ask for everyones assistance with regards to the problems we are encountering on our PIX525 firewall. Our encountered problem is as follow."PIX 525 experience sudden high CPU utilization every time a Vulnerability System Scan (third part app) is conducted. Based on the previous experiences, the high CPU utilization where experience when a host on a particular VLAN (214) is being scanned. Whenever we removed the said VLAN (214) in the network the CPU utilization of PIX 525 comes back to normal and all connectivity were resumed."The problem just recently appeared, we are conducting vulnerability system scan before and it goes successfully.
We have a 6509 core with the below modules running for a long time and the utilization used to be always 10 to 13 percent checking with the supplier it was told to us that due to the firewall modue we have and its normal Now 2 days back i noticed the utilzation had jumped to 90 % and now it happened again
I see that on runnung proc cpu
16407 56.1% 56.5% 55.9% ios-base
16430 35.3% 35.2% 33.9% iprouting.iosproc
the modules present
Mod Ports Card Type Model Serial No.--- ----- -------------------------------------- ------------------ ----------- 1 6 Firewall Module WS-SVC-FWM-1 SAD140901XA 3 16 16 port 1000mb GBIC ethernet
We recently added about 400 users to our network for a total of 1000. Looking at the ASDM we are holding very tight to 75% utilization and we have 256mbs. This is also running IOS 8.2(1). Our firewall recently crashed after a major download was forced through it. This was after only being booted up for about a week. We had reloaded it a week prior after having ran it for about a year without issue. We havent made any changes in the last month other than adding more users to our network.
We have an active-active pair of cisco ASA5580-20 with software version 8.4(1)9. There are 8 contexts on it (including admin and system). 1 context is active on Primary node and other 7 are active on Secondary node. User traffic is going through this 1 context (2 interfaces - inside to users, outside to internet) and there are peaks to 1.16M concurrent connections, max bandwidth is 1.25Gbps. CPU usage for this context in peak hours is 63%, but we noticed that when we run "show cpu usage context all" from system it shows that system context is using 25% of CPU and "Total CPU utilization" (form output of show cpu detailed - on system context) is 88% which is bad. In non peak hours - user context use 33.6% CPU, system use 14.5%, total CPU usage is 50.5% So, is it normal this cpu utilization on system context (system on Primary node)?
We have several ASA5540s and 5510s (v8.4.1) being managed by CSM (4.1) Every so often several of the ASAs will send SNMP messages to CSM stating very high CPU utilization reached, usually between 150% and 400% - sometimes as high as 4million %.Obviously you can't get greater than 100%.
Our Router 7606 is in a problem with high CPU Utilization. We are using one EBGP and one IBGP session. We are also running OSPF with area 0 between two IBGP router to exchange few local networks. When bandwidth cross 100 MB than only CPU use become 100%. when bandwidth consumption is 80MB CPU use become 80% end so on.
Out put is when bandwidth consumption is 34MB
CPU utilization for five seconds: 44%/43%; one minute: 42%; five minutes: 30% PID Runtime(ms) Invoked uSecs 5Sec 1Min 5Min TTY Process 78 44 9625 4 0.39% 0.03% 0.00% 2 Virtual Exec 13 40 375 106 0.07% 0.00% 0.00% 0 ARP Input 30 116 1098 105 0.07% 0.01% 0.00% 0 IPC Seat Manager
I have a hight CPU utilisation problem in my CISCO7609-S routers. the cpu utilisation can rise 99% et this is usually. In the moment of hight CPU the the process CPU give the following:
I have a 2811 that is really hitting the CPU hard. Nothing shows on CPU processes. It has an IPsec VPN tunnel back to HQ which also has a 2811 that terminates the VPN. The HQ has 2-3 IPsec tunnels to other remote sites. The CPU at the HQ avg 50% utilization during business hrs, peaks at about 80%. The remote one is very high 95% peaks, avg 80%-95% during business hours with bandwidth utilization of only 10-20Mbps. I read somewhere that its possible that fragmentation could be causing this. My question is, if I set the MTU to 1450 on the remote, I am guessing I will need to do all the other routers as well, the HQ and other remote sites? Siince they use the same outside interface to my HQ, is that correct?
I am observing very high CPU utilization on my Cisco 7206VXR (NPE-G1) Router. We have done all the necessary troubleshooting but not able to identify root cause. [code]
I am running Cisco Prime 4.2(UNIX version) on a VM. CPU utilization will run between 90 and 100% constantly. Reloading the server will stabilize the CPU for a short period of time, however the CPU usage will always return to 90-100% utilization. Currently I have about 130 devices added to the system.
we have 2 Cisco C4507 Switches working As Core Layer, but the CPU Utilization is about 54% most of the time and sometimes it goes up to 70% or 80% also.
which services are causing this utilization. [code]
I am working as net admin which is i need to monitoring and manage my workplace network( education center )I got a few question about network traffic flow. Here is the issued.I got high bandwidth utilization so high after office hours which is only on night. as we know, after office hours there is no person at the office but the traffic flow on bandwidth utilization is high.what are the possibilities of this issued?
I have Cisco 7613 on my edge(MPLS Backbone). CPU utilization is shooting to 100% at frequent intervals. When I tell vendors managing device they tell that it is happening due to one of my server(connected on Fast ethernet port of 100Mbps) generating heavy traffic. My questions are:
1. Can a router of 720Gbps capability be choked due to traffic generated by 100Mbps link?
2. Interrupt CPU process utilization is well below 10% at the said time. BGP router process consumes most of the CPU. Does this means that server in question is generating too many routing updates?
3. Is there any way that I can limit routing updates on a particular link?
4. how to check which link is causing more CPU utilization.
My router is running with BGP (One eBGP and One IBGP session). I have filterdown the BGP roting table by using prefix-List and default route to upstream router.But still found the CPU process is high (80%/80% with 60MB traffic).
Sh Proc CPU ------------------- CPU utilization for five seconds: 88%/88%; one minute: 87%; five minutes: 87% PID Runtime(ms) Invoked uSecs 5Sec 1Min 5Min TTY Process
We have a CISCO 7604 Router (GGSN) in our customer site. Since two weeks are observing high CPU utilization (even touching 100 percent). We performed a SNMP configuration on this routers 2 weeks back as well. But SNMP process is not consuming much CPU resources. The following is the output of the "show proc cpu" and "show proc cpu history.
------------------ show process cpu ------------------ CPU utilization for five seconds: 50%/15%; one minute: 49%; five minutes: 51% PID Runtime(ms) Invoked uSecs 5Sec 1Min 5Min TTY Process
I have a 7206VXR router doing policy routing with CEF enabled on all interfaces, no Cache Misses, Align Errors or failed buffers. CPU peaks up to 80% every two or three minutes. I suspect it is traffic related as I have a standby box and when it becomes the active on in the HSRP pair to high CPU load and LAN interface input errors follows it. see various show command output below. The router has a NPE-G1 and I'm using a gigabit port off of this on the LAn side and a E3 Frame Relay interface on the WAN side.
UK-DHC-Policy1#show buffersBuffer elements: 1118 in free list (1000 max allowed) 3539658545 hits, 0 misses, 1119 created Public buffer pools:Small buffers, 104 bytes (total 50, permanent 50, peak 229 @
I am facing lots of issue with cisco 4507 switch recently.. Every alternate day, its CPU is getting utilized by 99% and network stopped working..finally it has to be restared.
Below is the CPU utilization of the process:-
------------------ show process cpu ------------------ CPU utilization for five seconds: 99%/0%; one minute: 99%; five minutes: 99% PID Runtime(ms) Invoked uSecs 5Sec 1Min 5Min TTY Process
I have a Router 2821 with c2800nm-advipservicesk9-mz.124-24.T1.bin and with a Cisco Integrated Service Engine(s) Cisco Unity Express 7.1.1 in slot 1 , this router shows a high cpu utilization.I think is a bug with the IOS , because there is no voicemail configured on the CUE, there is no traffic to the CUE , just traffic from:
- voice calls - ospf
The ospf is not the cause of the high cpu , because the high cpu utilization appears before I put the ospf proccess on the router.
Five Cisco 1142 integrated in WDS infrastructure: 4 - AP, 1 - WDS with AP... At once on all access points loading of the processor increased to 100 %. And "show proc cpu" - in total in norm, log on all cisco identical below:
Jun 25 16:11:58: %DOT11-6-ROAMED: Station f0cb.a123.d6f9 Roamed to 0c85.257f.05d0 Jun 25 16:11:58: %DOT11-6-DISASSOC: Interface Dot11Radio0, Deauthenticating Station f0cb.a123.d6f9 Reason: Sending station has left the BSS Jun 25 16:23:36: %LEAPCL-3-TIMEOUT: AP Timed out authenticating to the WDS Jun 25 16:23:42: %WLCCP_AP-6-INFRA: WLCCP Infrastructure Authenticated Jun 25 16:23:44: %DOT11-6-DISASSOC: Interface Dot11Radio1, Deauthenticating Station a088.b405.7320 Jun 25 16:23:44: %DOT11-6-DISASSOC: Interface Dot11Radio1, Deauthenticating Station 0021.5dbf.a3da
[code].....
The problem suddenly began, proceeded about an hour and also suddenly ended...
