topic FWSM hight cpu utilization in Network Security

FWSM hight cpu utilization

ricky.eng — Mon, 11 Mar 2019 22:36:36 GMT

My FWSM is having high cpu utilization and only happen in the morning around 8am-9am. From the show process, I can tell the fixup feature is occupying the highest runtime. Question is ... is there any show command to tell which particular fixup feature is using the most?

FWSM hight cpu utilization

Marcin Latosiewicz — Wed, 29 Feb 2012 10:20:38 GMT

show perfmon

show service-policy

show np 3 stats | i FIX

Could be useful (not syntax checked).

Due to the way FWSM's hardware architecure is designed typical fixups (ICMP,TCP,UDP) should be done on NP3 and not in CPU.

Can I suggest opening a TAC case. TAC will collect:

- CPU profiler

- show proc a few times

(others)

And will tell you exectly what's going on.

FWSM hight cpu utilization

ricky.eng — Thu, 01 Mar 2012 09:15:55 GMT

Thanks Marcin,

I understand the three NP...What I notices is all three NP block threshold are hit and base on Cisco documentation, it said the FWSM is oversubsribed.

# sh np block

MAX FREE THRESH_0 THRESH_1 THRESH_2

NP1 (ingress) 32768 32768 17 899 36385

(egress) 521206 521206 0 0 0

NP2 (ingress) 32768 32768 41 1344 41968

(egress) 521206 521206 0 0 0

NP3 (ingress) 32768 32768 99 5519 34275

(egress) 521206 521206 0 0 0

If I go TAC, they probably will conclude the firewall is oversubsribed and require hardware upgrade and increase of capacity.

So, I am more interested to find out exactly what traffic causing the CPU statistis to go up but limited to know that the top run time is the fixup.

So, my next step is to find out which interface is the most congested so that I can SPAN the traffic to Sniffer/Ethereal for more detail traffic analysis. However, base on many of the #show traffic output gathered during CPU went high/down, the pkts/s counter didn't really fluactuate according to CPU.

FWSM hight cpu utilization

Marcin Latosiewicz — Thu, 01 Mar 2012 09:22:05 GMT

Give the guys in TAC some credit 🙂

Oversubscription might be contributing to your CPU problemem, but ...

Consider that traffic should not hit the CPU on FWSM unless it's inspected/IPv6 (and several other conditions).

From the looks of it, the box is not that oversubscribed ... thr 0 was only reached a few times doublesigits don't indicte a heavy oversubscription.

show perfmon

and

show service-policy

is where you should start 😉

FWSM hight cpu utilization

sumani1984 — Fri, 07 Mar 2014 07:02:02 GMT

diasble syslog and check once