topic Re: FMCv 7.2.5.1: High CPU load - how to troubleshoot? in Network Security

FMCv 7.2.5.1: High CPU load - how to troubleshoot?

swscco001 — Wed, 24 Apr 2024 06:51:10 GMT

Hello everybody,

our customer has a FMCv running sugg. rel. 7.2.5.1 and has a high CPU load of approx. 97%.
(see attached screen dump).

The VM has 4 CPUs, 32GB RAM and 250GB HDD.

The FMC is managing a HA of two Firepower 1120 running rel. 7.2.5.

A FMC reboot does not solve the issue.

A "Run All" in the Health Monitor does not solve the issue.

The DBCheck.pl does not show any error (see attached output).

What could be the reason of the high CPU load and how can
we get rid of?

Thanks a lot for every hint!

Bye
R.

Re: FMCv 7.2.5.1: High CPU load - how to troubleshoot?

Jon Are Endrerud — Thu, 25 Apr 2024 12:10:42 GMT

When logging into CLI --> expert, what is the "top" command say about the processes using cpu ?

Re: FMCv 7.2.5.1: High CPU load - how to troubleshoot?

Marvin Rhoads — Thu, 25 Apr 2024 13:37:36 GMT

@swscco001 In addition to the "top" command suggested by @Jon Are Endrerud , you can also check the Events/Second coming in to the FMC in the Health Monitor (may need to switch to the new light UI under your user profile).

Re: FMCv 7.2.5.1: High CPU load - how to troubleshoot?

Marius Gunnerud — Fri, 26 Apr 2024 11:14:22 GMT

I have seen a few of these High CPU issues on post 7.2.x versions of FTD. In the worst cases we had to reload the FTD as the CLI was unresponsive. In each of these scenarios the underlying issue was always a bug and is fixed with an upgrade to newer version.

Other possible scenarios could be excessive logging and IPS that is triggering on a lot of packets (not necessarily because of an attack).

Commands you could use to identify what is causing the high CPU:

show cpu core all

show processes cpu-usage non-zero

show cpu usage-hog

Expert mode: top

Re: FMCv 7.2.5.1: High CPU load - how to troubleshoot?

swscco001 — Mon, 29 Apr 2024 08:43:03 GMT

Hello everybody,

with the FMC upgrade to rel. 7.2.6 the high CPU load disappeared.

Thanks a lot!

Bye
R.

Re: FMCv 7.2.5.1: High CPU load - how to troubleshoot?

Marius Gunnerud — Mon, 29 Apr 2024 08:46:53 GMT

I am glad the upgrade to 7.2.6 solved the issue for you. However, for you and anyone else that finds this post, be aware of the following bug that can cause the FTD to go into a boot loop if you are using SNMP.

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwi63113