We have a pair of CSS11503s with two SSL modules in each chassis. We balanced our numerous SSL VIPs across them based on CPU. In other words, we put some VIPs on one module, some on the other until we had both CPUs about 70% utilization at peak hours. (show sys)
We have noticed recently that the available memory on module2 depletes badly during high traffic and never recovers. Theoretically, we are guessing this is becuase the SSL table size increases. Recently, the available memory was dangerously low. I flipped to the redundant box and it showed the same behavior, so it's not hardware. When we did a "show ssl stat", we saw that the "active ssl flows high water mark" indicated 27,905 flows.
I know these modules are rated (in Cisco's white papers) as 20,000 concurrent sessions and 1,000 new sessions per second. What we are wondering is if the 27,905 flows indicates concurrent connections or is the "flows" different from "sessions" or "connections".
We could reallocate a bunch of our SSL VIPs from one module to the other, but then we risk pushing the CPU well past 70% utilization on that module. I'm also not certain going from 384MB available to 12MB available on the busier SSL module should be expected behavior.
The only pattern I can find is that the afflicted module happens to have the ONLY content rules that require a urlrewrite in their associated ssl-server entries. I recall that there were bugs with urlrewrites in previous versions. (we have 7.4.105s now)
Just thought I'd toss this out - it's bizarre and alarming behavior on these CSSes.
CWB
