Cisco ISE GUI slow

[farih-kurniawan]

Greetings everyone, we had a problem with Cisco ISE GUI which slow and unresponsive sometimes. i already check CPU and Memory utilization, it's normal. So i use tech Top and found this, in MIB Swap it's look 0.0 free  

is there any correlation with causing ISE GUI slow or unresponsive sometimes ? or maybe i don't know where to check CPU and Memory utlization correctly. How to check correctly in the GUI or CLI to find CPU and Memory utilization. and i found in the dashboard, System Summary widget got blank. How to check this, Thank you

[farih-kurniawan]

we use Cisco ISE version 3.3.0.430 patch 7

[Cristian Matei]

Hi,

    These kind of issues are challenging to get to the root cause. What was your previous ISE version or patch level and did you had the same challenges with that version? How often does it happen when you man sometimes? When it happens, did you try at the same time from another computer to isolate the problem? Are you using Chrome as your browser to manage ISE? Let' first address this area. Is this a VM or physical deployment? If it's a VM, what is the vCPU, HDD and allocated memory count?

    At the same time, I see high CPU and memory on jsvc process, which could point to buggy behaviour (memory leaks or lack of resources). I also see high CPU on diagrunner process, which could point to excessive data collection, at the same time no memory consumption for this process which is weird. This would be the second era to investigate, which could lead to a new batch being applied or version upgrade.

Thanks,

Cristian.

[farih-kurniawan]

Hi @Cristian Matei , we start from patch 3 and then we update patch to 6 and then update patch again to patch 7 until now. and now they release patch 8. in a previous patch in this cust. there is no issue like this. it's first time. But in another customer, where the patch is still patch 3, they had an issue like this. i think this issue had no correlation with the patch maybe. Thank you

[balaji.bandi · Accepted solution]

High CPU usage by a specific jsvc/diag  process is often a symptom of underlying problems

https://community.cisco.com/t5/network-access-control/cscvn91978-jsvc-process-taking-up-high-amount-of-swap-space/td-p/5208622

Is this a fresh installation, or was it slow after the upgrade?

What kind of deployment? How many end devices is this used for? TACACS and Radius?

I generally do basic checks as below :

show cpu usage
show memory statistics
show disk
show application status ise

Another thing is, is the ping ok from your end device when you access the ISE GUI?  How about the same subnet where ISE is located, on the same VLAN? Does that work as expected?

have you tried a different browser

other troubleshooting tips :

https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/222906-understand-ise-services-purpose-and-tro.html#toc-hId-1638366738

[farih-kurniawan]

Hi @balaji.bandi, no, it's not new deployment and we had 2 node of Cisco ISE. we use cross persona between nodes, it seems 4K end users with tacacs and Radius. Ping looks fine and we already try different browser too

[Marcelo Morais · Accepted solution]

@farih-kurniawan ,

 your Node is up for 124+ days, and you are having a Memory Leaking issue (MiB Swap Free: 0.0).

Use the following commands to reload the Node:

ise/admin# application stop ise
ise/admin# reload

Hope this helps !

[farih-kurniawan]

yaa you right @Marcelo Morais. we already try that (reload Cisco ISE) and MIB Swap back to normal again with enough free space. I wonder is this issue will happen again in the future. is this like routine activity to reload Cisco ISE ? Thank you

[Marcelo Morais]

@farih-kurniawan ,

 unfortunately, the problem will likely happen again in the future.

 This issue is a combination of the ISE version and the Customer's characteristics (resources used, number of RADIUS Requests per day, Node characteristics, etc.).

 In some Customers, I needed to run this routine every 45 to 90 days.

My suggestion:

• observe the result of the MiB Swap Free every 7 days to check when the problem would become critical in your particular case
• after this observation, perform a new reload.
• try disabling unused Services, Features, or Probes.
• start the cycle again.

Note: what is your SNS / VM model (HD, CPU, and RAM) ?

Hope this helps !