topic ASA CPU higher than normal in Network Security

topic ASA CPU higher than normal in Network Security https://community.cisco.com/t5/network-security/asa-cpu-higher-than-normal/m-p/2363198#M308814 <P>Hello,</P><P></P><P>Our ASA CPU level has been higher than normal over the last few weeks and I can see a reason why.  </P><P></P><P>I have noiced that tha dashboard has had the top graphs/tables re-enabled, which I beleive can cause the CPU to rise, how can I turn these off again?</P><P></P><P>Thanks</P> Tue, 12 Mar 2019 03:05:32 GMT Andy White 2019-03-12T03:05:32Z ASA CPU higher than normal https://community.cisco.com/t5/network-security/asa-cpu-higher-than-normal/m-p/2363198#M308814 <P>Hello,</P><P></P><P>Our ASA CPU level has been higher than normal over the last few weeks and I can see a reason why.  </P><P></P><P>I have noiced that tha dashboard has had the top graphs/tables re-enabled, which I beleive can cause the CPU to rise, how can I turn these off again?</P><P></P><P>Thanks</P> Tue, 12 Mar 2019 03:05:32 GMT https://community.cisco.com/t5/network-security/asa-cpu-higher-than-normal/m-p/2363198#M308814 Andy White 2019-03-12T03:05:32Z ASA CPU higher than normal https://community.cisco.com/t5/network-security/asa-cpu-higher-than-normal/m-p/2363199#M308822 <HTML><HEAD></HEAD><BODY><P>Can you share</P><P></P><P>Show processes cpu-usage sorted non-zero</P><P></P><P>Clear interfaces</P><P></P><P>show interface | include errors</P><P></P><P>After 5 minutes</P><P></P><P>show interface | include errors</P><P></P><P>Rate all of the helpful posts!!! <BR /> <BR />Regards, <BR /> <BR />Jcarvaja <BR /> <BR /><SPAN>Follow me on </SPAN><A class="jive-link-external-small" href="http://laguiadelnetworking.com">http://laguiadelnetworking.com</A></P></BODY></HTML> Fri, 15 Nov 2013 13:40:55 GMT https://community.cisco.com/t5/network-security/asa-cpu-higher-than-normal/m-p/2363199#M308822 Julio Carvajal 2013-11-15T13:40:55Z Re: ASA CPU higher than normal https://community.cisco.com/t5/network-security/asa-cpu-higher-than-normal/m-p/2363200#M308833 <HTML><HEAD></HEAD><BODY><P>Sure:</P><P></P><P> show processes cpu-usage non-zero</P><P>PC                    Thread         5Sec      1Min     5Min     Process</P><P>0x09303f3c   0x6d5ac568      0.1%      0.0%     0.0%     websns_snd</P><P>0x0911595d   0x6d5ac778     0.1%      0.1%     0.1%     websns_rcv_tcp</P><P>0x08c7e425   0x6d5c0b48     0.1%      0.1%     0.0%     Unicorn Admin Handler</P><P>0x0911d204   0x6d5af0b8      0.5%      0.4%     0.4%     tcp_thread</P><P>0x090c7a4d   0x6d5a6688     0.1%      0.0%     0.0%     ssh</P><P>0x091618b9   0x6d5ab6f8      0.0%      0.1%     0.1%     snmp</P><P>0x087a174e   0x6d5af8f8       0.1%      0.1%     0.1%     IP Thread</P><P>0x0865991b   0x6d5b3d08     0.0%      0.1%     0.1%     IKE Daemon</P><P>0x0828fb01   0x6d5c3278      68.8%    62.3%    59.7%   Dispatch Unit</P><P>0x098a2535   0x6d5bb8c8     0.0%      0.1%     0.0%     Checkheaps</P><P>0x087a8efe   0x6d5af6e8       0.1%      0.0%     0.0%     ARP Thread</P><P></P><P>show interface  | include errors</P><P>        0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort</P><P>        0 output errors, 0 collisions, 0 interface resets</P><P>        790 input errors, 0 CRC, 0 frame, 790 overrun, 0 ignored, 0 abort</P><P>        0 output errors, 0 collisions, 0 interface resets</P><P>        637 input errors, 0 CRC, 0 frame, 637 overrun, 0 ignored, 0 abort</P><P>        0 output errors, 0 collisions, 0 interface resets</P><P>        0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort</P><P>        0 output errors, 0 collisions, 0 interface resets</P><P>        0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort</P><P>        0 output errors, 0 collisions, 0 interface resets</P><P></P><P>Thanks</P></BODY></HTML> Fri, 15 Nov 2013 14:12:28 GMT https://community.cisco.com/t5/network-security/asa-cpu-higher-than-normal/m-p/2363200#M308833 Andy White 2013-11-15T14:12:28Z ASA CPU higher than normal https://community.cisco.com/t5/network-security/asa-cpu-higher-than-normal/m-p/2363201#M308838 <HTML><HEAD></HEAD><BODY><P>Hello, </P><P></P><P>So the CPU is high due to DIspatch Unit process (Traffic handeling related)</P><P></P><P>That being said we can see that interface 1 and 2 are the ones receiving more traffic.</P><P></P><P>So my recommendation is:</P><P></P><P>Clear the interfaces with the command</P><P>clear interfaces</P><P></P><P>give 4 minutes</P><P>and do</P><P></P><P>show interfaces | include errors</P><P></P><P>Also run</P><P></P><P>show local-host | includehost|count/<EM>limit</EM></P><P></P><P><EM>And look for the hosts with the largest amount of conn.<BR /></EM></P><P></P><P></P><P></P><P>Rate all of the helpful posts!!! <BR /> <BR />Regards, <BR /> <BR />Jcarvaja <BR /> <BR /><SPAN>Follow me on </SPAN><A class="jive-link-external-small" href="http://laguiadelnetworking.com">http://laguiadelnetworking.com</A></P></BODY></HTML> Fri, 15 Nov 2013 14:31:22 GMT https://community.cisco.com/t5/network-security/asa-cpu-higher-than-normal/m-p/2363201#M308838 Julio Carvajal 2013-11-15T14:31:22Z Re: ASA CPU higher than normal https://community.cisco.com/t5/network-security/asa-cpu-higher-than-normal/m-p/2363202#M308843 <HTML><HEAD></HEAD><BODY><P>Will do, just noticed this didn't work:</P><P></P><P>show local-host | includehost|count/limit</P><P>                                                ^</P><P>ERROR: % Invalid input detected at '^' marker.</P></BODY></HTML> Fri, 15 Nov 2013 14:34:59 GMT https://community.cisco.com/t5/network-security/asa-cpu-higher-than-normal/m-p/2363202#M308843 Andy White 2013-11-15T14:34:59Z Re: ASA CPU higher than normal https://community.cisco.com/t5/network-security/asa-cpu-higher-than-normal/m-p/2363203#M308851 <HTML><HEAD></HEAD><BODY><P>It's</P><P></P><P>show local-host | include host|count/limit</P><P></P><P></P><P>Rate all of the helpful posts!!! <BR /> <BR />Regards, <BR /> <BR />Jcarvaja <BR /> <BR /><SPAN>Follow me on </SPAN><A class="jive-link-external-small" href="http://laguiadelnetworking.com">http://laguiadelnetworking.com</A></P></BODY></HTML> Fri, 15 Nov 2013 14:42:31 GMT https://community.cisco.com/t5/network-security/asa-cpu-higher-than-normal/m-p/2363203#M308851 Julio Carvajal 2013-11-15T14:42:31Z ASA CPU higher than normal https://community.cisco.com/t5/network-security/asa-cpu-higher-than-normal/m-p/2363204#M308854 <HTML><HEAD></HEAD><BODY><P>Strong suggestion would be to use Netflow and collector of choice against a Cisco switch that can monitor real time, the reason I state this is because if you need to cut down someone that is doing something that you are not allowing you would need to wait for the flow to close down to identify the source through Netflow on the ASA but on a Cisco switch you would identify the source immediately.</P><P></P><P></P><P>You can also enable threat detection feature that will tell you who is the top talker at a moment but not a history of that user.</P><P></P><P><A class="jive-link-wiki-small" href="https://community.cisco.com/docs/DOC-6113">https://supportforums.cisco.com/docs/DOC-6113</A><SPAN> </SPAN></P></BODY></HTML> Sun, 17 Nov 2013 22:13:09 GMT https://community.cisco.com/t5/network-security/asa-cpu-higher-than-normal/m-p/2363204#M308854 jumora 2013-11-17T22:13:09Z