cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
5949
Views
0
Helpful
2
Replies

High CPU due to dispatch unit in cisco ASA 5540

sachinuit
Level 1
Level 1

High CPU due to dispatch unit in cisco ASA 5540

ciscoasa# sh processes cpu-usage
PC         Thread       5Sec     1Min     5Min   Process
0805520c   ad5afdf8     0.0%     0.0%     0.0%   block_diag
081a8d34   ad5afa08    82.6%    82.1%    82.3%   Dispatch Unit
083b6c05   ad5af618     0.0%     0.0%     0.0%   CF OIR
08a60aa0   ad5af420     0.0%     0.0%     0.0%   lina_int
08069f06   ad5aee38     0.0%     0.0%     0.0%   Reload Control Thread
08072196   ad5aec40     0.0%     0.0%     0.0%   aaa
08c76f3d   ad5aea48     0.0%     0.0%     0.0%   UserFromCert Thread
080a6f36   ad5ae658     0.0%     0.0%     0.0%   CMGR Server Process
080a7445   ad5ae460     0.0%     0.0%     0.0%   CMGR Timer Process
081a815c   ad5ada88     0.0%     0.0%     0.0%   dbgtrace
0844d75c   ad5ad2a8     0.0%     0.0%     0.0%   557mcfix
0844d57e   ad5ad0b0     0.0%     0.0%     0.0%   557statspoll
08c76f3d   ad5abef8     0.0%     0.0%     0.0%   netfs_thread_init
09319755   ad5ab520     0.0%     0.0%     0.0%   Chunk Manager
088e3f0e   ad5ab328     0.0%     0.0%     0.0%   PIX Garbage Collector
088d72d4   ad5ab130     0.0%     0.0%     0.0%   IP Address Assign
08ab1cd6   ad5aaf38     0.0%     0.0%     0.0%   QoS Support Module
08953cbf   ad5aad40     0.0%     0.0%     0.0%   Client Update Task
093698fa   ad5aab48     0.0%     0.0%     0.0%   Checkheaps
08ab6205   ad5aa560     0.0%     0.0%     0.0%   Quack process
08b0dd52   ad5aa368     0.0%     0.0%     0.0%   Session Manager
08c227d5   ad5a9f78     0.0%     0.0%     0.0%   uauth
08bbf615   ad5a9d80     0.0%     0.0%     0.0%   Uauth_Proxy
08bf5cbe   ad5a9798     0.0%     0.0%     0.0%   SSL
08c20766   ad5a95a0     0.0%     0.0%     0.0%   SMTP
081c0b4a   ad5a93a8     0.0%     0.0%     0.0%   Logger
08c19908   ad5a91b0     0.0%     0.0%     0.0%    Syslog Retry Thread
08c1346e   ad5a8fb8     0.0%     0.0%     0.0%   Thread Logger
08e47c82   ad5a81f0     0.0%     0.0%     0.0%   vpnlb_thread
08f0f055   ad5a7a10     0.0%     0.0%     0.0%   pci_nt_bridge
0827a43d   ad5a7620     0.0%     0.0%     0.0%   TLS Proxy Inspector
08b279f3   ad5a7428     0.0%     0.0%     0.0%   emweb/cifs_timer
086a0217   ad5a7230     0.0%     0.0%     0.0%   netfs_mount_handler
08535408   ad5a7038     0.0%     0.0%     0.0%   arp_timer
0853d18c   ad5a6e40     0.0%     0.0%     0.0%   arp_forward_thread
085ad295   ad5a6c48     0.0%     0.0%     0.0%   Lic TMR
08c257b1   ad5a6a50     0.0%     0.0%     0.0%   tcp_fast
08c28910   ad5a6858     0.0%     0.0%     0.0%   tcp_slow
08c53f79   ad5a6660     0.0%     0.0%     0.0%   udp_timer
080fe008   ad5a6468     0.0%     0.0%     0.0%   CTCP Timer process
08df6853   ad5a6270     0.0%     0.0%     0.0%   L2TP data daemon
08df7623   ad5a6078     0.0%     0.0%     0.0%   L2TP mgmt daemon
08de39b8   ad5a5e80     0.0%     0.0%     0.0%   ppp_timer_thread
08e48157   ad5a5c88     0.0%     0.0%     0.0%   vpnlb_timer_thread
081153ff   ad5a5a90     0.0%     0.0%     0.0%   IPsec message handler
081296cc   ad5a5898     0.0%     0.0%     0.0%   CTM message handler
089b2bd9   ad5a56a0     0.0%     0.0%     0.0%   NAT security-level reconfiguration
08ae1ba8   ad5a54a8     0.0%     0.0%     0.0%   ICMP event handler

 

I want exact troubleshooting.

(1) Steps to follow.

(2) Required configuration

(3) Any good suggestions

(4) Any Tool to troubleshoot.

Suggestions are welcome

1 Accepted Solution

Accepted Solutions

Vinod Arya
Cisco Employee
Cisco Employee

Hello,

NMS is probably not the right community to t/s this. You probably want to move this to Security group (Security > Firewalling).

In the meanwhile, i have some details to share for you to check, though i am not a security/ASA expert.

The Dispatch Unit is a process that continually runs on single-core ASAs (models 5505, 5510, 5520, 5540, 5550). The Dispatch Unit takes packets off of the interface driver and passes them to the ASA SoftNP for further processing; it also performs the reverse process.

To determine if the Dispatch Unit process is utilizing the majority of the CPU time, use the command show cpu usage and show process cpu-usage sorted non-zero
 
show cpu usage (and show cpu usage detail) will show the usage of the ASA CPU cores:

ASA# show cpu usage
CPU utilization for 5 seconds = 0%; 1 minute: 1%; 5 minutes: 0%

show process cpu-usage sorted non-zero will display a sorted list of processes that are using the CPU usage. 
 
In the example below, the Dispatch Unit process has used 50 percent of the CPU for the last 5 seconds:

ASA# show process cpu-usage sorted non-zero
0x0827e731   0xc85c5bf4    50.5%    50.4%    50.3%   Dispatch Unit
0x0888d0dc   0xc85b76b4     2.3%     5.3%     5.5%   esw_stats
0x090b0155   0xc859ae40     1.5%     0.4%     0.1%   ssh
0x0878d2de   0xc85b22c8     0.1%     0.1%     0.1%   ARP Thread
0x088c8ad5   0xc85b1268     0.1%     0.1%     0.1%   MFIB
0x08cdd5cc   0xc85b4fd0     0.1%     0.1%     0.1%   update_cpu_usage

If Dispatch Unit is listed as a top consumer of CPU usage, then use this document to narrow down what might be causing the Dispatch Unit process to be so active.

Most cases of high CPU utilization occur because the Dispatch Unit process is high. Common causes of high utilization include:
 
Oversubscription
Routing loops
Host with a high number of connections
Excessive system logs
Unequal traffic distribution

More t/s details can be shared by the ASA members from the community.

HTH

-Thanks

Vinod

 

-Thanks Vinod **Rating Encourages contributors, and its really free. **

View solution in original post

2 Replies 2

Vinod Arya
Cisco Employee
Cisco Employee

Hello,

NMS is probably not the right community to t/s this. You probably want to move this to Security group (Security > Firewalling).

In the meanwhile, i have some details to share for you to check, though i am not a security/ASA expert.

The Dispatch Unit is a process that continually runs on single-core ASAs (models 5505, 5510, 5520, 5540, 5550). The Dispatch Unit takes packets off of the interface driver and passes them to the ASA SoftNP for further processing; it also performs the reverse process.

To determine if the Dispatch Unit process is utilizing the majority of the CPU time, use the command show cpu usage and show process cpu-usage sorted non-zero
 
show cpu usage (and show cpu usage detail) will show the usage of the ASA CPU cores:

ASA# show cpu usage
CPU utilization for 5 seconds = 0%; 1 minute: 1%; 5 minutes: 0%

show process cpu-usage sorted non-zero will display a sorted list of processes that are using the CPU usage. 
 
In the example below, the Dispatch Unit process has used 50 percent of the CPU for the last 5 seconds:

ASA# show process cpu-usage sorted non-zero
0x0827e731   0xc85c5bf4    50.5%    50.4%    50.3%   Dispatch Unit
0x0888d0dc   0xc85b76b4     2.3%     5.3%     5.5%   esw_stats
0x090b0155   0xc859ae40     1.5%     0.4%     0.1%   ssh
0x0878d2de   0xc85b22c8     0.1%     0.1%     0.1%   ARP Thread
0x088c8ad5   0xc85b1268     0.1%     0.1%     0.1%   MFIB
0x08cdd5cc   0xc85b4fd0     0.1%     0.1%     0.1%   update_cpu_usage

If Dispatch Unit is listed as a top consumer of CPU usage, then use this document to narrow down what might be causing the Dispatch Unit process to be so active.

Most cases of high CPU utilization occur because the Dispatch Unit process is high. Common causes of high utilization include:
 
Oversubscription
Routing loops
Host with a high number of connections
Excessive system logs
Unequal traffic distribution

More t/s details can be shared by the ASA members from the community.

HTH

-Thanks

Vinod

 

-Thanks Vinod **Rating Encourages contributors, and its really free. **

I wonder if this may be the same reason that is causing the problem I'm having in the Forum:

https://community.cisco.com/t5/firewalls/high-latency-icmp-snmp-tool-to-asa-5540/m-p/3750952/highlight/false#M174433

In my case:

------------------ show cpu usage ------------------

CPU utilization for 5 seconds = 45%; 1 minute: 46%; 5 minutes: 45%

 

------------------ show process ------------------


PC SP STATE Runtime SBASE Stack Process
Lwe 0805521c 702a4544 0a00d118 0 702a2640 7544/8192 block_diag
Mrd 081abd84 702d4214 0a00c034 1388745890 702b43d0 120404/131072 Dispatch Unit

------------------ show memory ------------------

Free memory: 787486032 bytes (37%)
Used memory: 1359997616 bytes (63%)
------------- ----------------
Total memory: 2147483648 bytes (100%)

------------------ show conn count ------------------

8795 in use, 95265 most used

------------------ show xlate count ------------------

3312 in use, 8853 most used

Review Cisco Networking for a $25 gift card