topic Re: FMC error has unknown CPU number in Network Security

FMC error has unknown CPU number

F1r5Sceen — Tue, 22 Apr 2025 19:20:21 GMT

Hello all,

I have an FMC that reports that CPU24 has reached 100% usage but I dont have a cpu24 that I can find. I have run the show CPU and I only have 11 on a FirePower 2130 running 7.2.5.2 406. Any ideas on how to find this CPU on this FirePower?

Re: FMC error has unknown CPU number

nspasov — Wed, 23 Apr 2025 03:04:30 GMT

The 2130 utilizes x86 CPU complex to run Snort and NPU for the data-plane. The output from the command that you shared shows the data-plane CPU cores only. The fastest way to get all CPU cores via CLI is: expert -> pmtool show affinity. Otherwise, from the non-expert CLI you can use: 1) Show cpu core (Data-plane), show cpu system (System), show snort cpu.

Thank you for rating helpful posts!

Re: FMC error has unknown CPU number

F1r5Sceen — Wed, 23 Apr 2025 04:58:23 GMT

Thank you nspasov! I was able to see the "mystery" CPUs. 🙂 Unfortunately, it did not show me what or why the CPUs are running at 100%. I can see it is running due to snort but I dont know what interface the offender is on or what ip address its coming from... Any suggestions or should I start another post?

Re: FMC error has unknown CPU number

nspasov — Wed, 23 Apr 2025 15:10:12 GMT

There are several things that can cause this but I suspect it was an "elephant/fat flow" that was being inspected by Snort and pinned to this particular core. You have several options to gain visibility into such problems:

Depending on the version you are running, you can integrate your FMC with Cisco Security Cloud and utilize AIOps services. There is a wonderful Cisco Live Session (BRKSEC-2166) that goes over this.
You can utilize the health monitoring in the FMC and create yourself a dashboard
If you want to get very technical, there is another Cisco Live Session that goes into a great detail about such topics BRKSEC-3274
Of course, Cisco TAC is always an option 🙂

Thank you for rating helpful posts!

Re: FMC error has unknown CPU number

F1r5Sceen — Wed, 23 Apr 2025 15:16:18 GMT

Thanks again! I am looking over the logs because the flow has stopped.