topic Re: CPU and memory utilization on ASA in Network Security

CPU and memory utilization on ASA

gnaveen — Mon, 11 Mar 2019 19:41:51 GMT

We have been told by our hosting vendor that they can't collect CPU and memory utilization on Cisco ASA's

"This is currently not possible as the ASA version 8.0(5) does not support the HostResource.MIB."

- Can the CPU and memory information be collected only by HostResource.MIB? Is there any other MIB which can get us the information?

- I know that we can get CPU and memory information from ASDM also, but not sure how we can tune or integrate to get information everyday?

This is urgent and appreciate any help on this.

-NG

Re: CPU and memory utilization on ASA

mirober2 — Sun, 30 Jan 2011 16:58:37 GMT

Hi NG,

You can get the CPU utilization on 8.0(5) from the following OIDs:

1.3.6.1.4.1.9.9.109.1.1.1.1.3. cpmCPUTotal5sec
1.3.6.1.4.1.9.9.109.1.1.1.1.4. cpmCPUTotal1min
1.3.6.1.4.1.9.9.109.1.1.1.1.5. cpmCPUTotal5min

These OIDs will give you the memory information:

1.3.6.1.4.1.9.9.48.1.1.1.5. ciscoMemoryPoolUsed
1.3.6.1.4.1.9.9.48.1.1.1.6. ciscoMemoryPoolFree

You can also do an snmpwalk on your ASA to see which ones are of particular use to you.

Hope that helps.

-Mike

Re: CPU and memory utilization on ASA

gnaveen — Sun, 30 Jan 2011 18:39:08 GMT

Thanks Mike!

- What does HostResource.MIB used for?

- I don't see these MIBs listed in the supportlist?

ftp://ftp-sj.cisco.com/pub/mibs/supportlists/asa/asa-supportlist.html

- Do you have the configuration example as how to do snmpwalk on the ASA?

-NG

Re: CPU and memory utilization on ASA

mirober2 — Sun, 30 Jan 2011 18:55:13 GMT

Hi NG,

I'm not familiar with that particular MIB, but a quick search turned up the RFC for it:

http://www.faqs.org/rfcs/rfc2790.html

However, as you mentioned, if the MIB isn't in the list of supported MIBs for the ASA, you won't be able to query any of those OIDs.

The minimum required configuration for doing SNMP polling is as follows:

snmp-server enable

snmp-server host community

Once that is enabled, you can do the following using snmpwalk:

snmpwalk -v 2c -c

If you don't have a client with snmpwalk available, you can also use 'show snmp-server oidlist' from the ASA's CLI to get a list of all of the supported OIDs.

More info on configuring SNMP polling can be found here:

http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/monitor_snmp.html

Hope that helps.

-Mike

Re: CPU and memory utilization on ASA

gnaveen — Mon, 31 Jan 2011 15:41:36 GMT

As per ftp://ftp-sj.cisco.com/pub/mibs/supportlists/asa/asa-supportlist.html it looks like the MIBs which you mentioned above are included in CISCO-PROCESS-MIB and CISCO-MEMORY-POOL-MIB

ftp://ftp.cisco.com/pub/mibs/v2/CISCO-PROCESS-MIB.my

REVISION        "200105180000Z"
    DESCRIPTION
        "The objects cpmProcExtUtil5Sec, cpmProcExtUtil1Min,
        cpmProcExtUtil5Min,cpmCPUTotal5sec, cpmCPUTotal1min
        and cpmCPUTotal5min are deprecated to increase the
        value range as 0..100. The table cpmProcessExtTable
        is deprecated. The new objects added are
        cpmProcessExtRevTable, cpmProcExtMemAllocatedRev,
        cpmProcExtMemFreedRev, cpmProcExtInvokedRev,
        cpmProcExtRuntimeRev, cpmProcExtUtil5SecRev,
        cpmProcExtUtil1MinRev, cpmCPUTotal5MinRev,
        cpmCPUTotal5secRev, cpmCPUTotal1minRev and
        cpmCPUTotal5minRev."

ftp://ftp.cisco.com/pub/mibs/v2/CISCO-MEMORY-POOL-MIB.my

    REVISION "200107310000Z"
    DESCRIPTION
        "Added a new table, ciscoMemoryPoolUtilizationTable, which
         provides information about memory utilization."
    REVISION "199602010000Z"

So, if I run CISCO-PROCESS-MIB and CISCO-MEMORY-POOL-MIB, I should be able to get the CPU and memory utilization on ASA. Is my understanding correct?

-NG

Re: CPU and memory utilization on ASA

mirober2 — Mon, 31 Jan 2011 16:33:02 GMT

Hi NG,

Yes, that is correct. CISCO-PROCESS-MIB is just shorthand for the 1.3.6.1.4.1.9.9.109 portion of the OID I listed in my previous post. Likewise, CISCO-MEMORY-POOL-MIB is shorthand for 1.3.6.1.4.1.9.9.48.

-Mike