topic Re: ISE 2.1 CPU Utilization 90% in Network Access Control

ISE 2.1 CPU Utilization 90%

Ali — Fri, 21 Feb 2020 18:47:21 GMT

Hi Community,

We are currently running with ISE 2.1 patch 2,4 on SNS-3515-k9

our CPU utilization is going around 90% constantly, when i checked CPU Statistic in CLI its shows Database Server is occupying around 165 processes and containing 8.9 CPU utilization.

Due to this issue not able to login GUI access sometime.

How to resolve the issue does or any one face this issue.

Helpful reply would be highly appreciative.

Thanks

Re: ISE 2.1 CPU Utilization 90%

abhishek.marat1 — Tue, 06 Mar 2018 16:42:16 GMT

We had this issue with ISE 2.2 patch 3. We had about 2 TAC cases open. The TAC engineer after some digging pointed that it is bug and was resolved in the next patch. So we patched our ISE servers to patch 5 and that resolved the issue. We haven't seen CPU spikes ever since then. I would recommend opening a TAC case if possible and ask the TAC engineer if this is caused by a bug (sometimes the BUG ID is not available publicly and is only seen by the TAC engineers). If this cannot be done, i would patch the ISE servers to the latest patch. Please read release notes for that patch version and what issues it resolves before doing so.

P.S. Please rate helpful posts. Thank you!

Re: ISE 2.1 CPU Utilization 90%

Ali — Wed, 07 Mar 2018 05:38:16 GMT

Hi Abhishek,

Thanks for your reply and information.
Currently we are getting the CPU hike on daily basis, so had to open a case and TAC is working on the issue.
I have read few docs and found most cases its the bug that causes the hike so option is to get the patch.
we are waiting for the update from TAC, once we get an update we go for the next step.

Re: ISE 2.1 CPU Utilization 90%

soumbis12 — Thu, 06 Sep 2018 07:56:33 GMT

Hi Community,

CSCvc86247 High CPU caused by "infinite loop" threads on PSN
CSCvc75209 ISE 2.1 and above shows High IO and High CPU usage for oracle process on MNT mode.
CSCvd56372 ISE displays Dead lock in oracle alert log.
ORA-00060: Deadlock detected. See Note 60.1 at My Oracle Support for Troubleshooting ORA-60 Errors. More info in file /opt/oracle/base/diag/rdbms/cpm10/cpm10/trace/cpm10_j001_25964.trc
EDF_LOG is large which can cause backups to fail and disk space issue

In addition to bugs, configuration that might add to CPU load:

The Endpoint Attribute Filter check box is not checked and should be. When the EndPoint attribute filter is not enabled, ISE can suffer performance issues when too much un-needed profiler data is being used. Go to ADMINISTRATION > SETTINGS > PROFILING and check "Enabled" on the EndPoint Attribute Filter Checkbox
Logging Suppression protects Identity Services Engine from misconfigured endpoints by no logging un-needed RADIUS Authentication and Accounting packets, it is recommended to keep logging suppression enabled at all times. Suppression should be enabled under Administration -> System -> Settings -> Protocols -> RADIUS
Logging Suppression prevents the Monitoring and Troubleshooting node from being overwhelmed with repeated successful authentications, adding a repeat count instead of another full record. Suppression should be enabled under Administration -> System -> Settings -> Protocols -> RADIUS

All above mentioned bugs are resolved in latest patch. To resolve all issues that are causing high CPU you should install latest patch, however to resolve bugs that I was able to verify you are hitting you can install patch 5.