11-24-2011 05:24 AM - edited 03-10-2019 05:32 AM
Hi,
I have a problem with an IPS 4240 cpu utilization. The cpu is reaching 100% and the traffic is being dropped. The IPS has been updated to the latest release 7.0.6 with latest signature update but the problem persisted.
I found out that there is a signature firing more often from certain internal ip addresses and the signature has not been seen before. i disabled the signature and IPS CPU's was back to normal. But after few days, the CPU problem came back and i am not able to find a solution for it. Where the only solution is to put the IPS is in bypass mode on(never inspect traffic) where the cpu goes down to 7%.
i tryied to searched the forum and the only suggestion is to upgrade from E3 to E4 or upgrade to the latest version (which i already have done).
Anybody has any suggestion on how to troubleshoot or solve this problem.
Thank you in advanced.
George
11-24-2011 06:55 AM
Hi,
Is the CPU at 100% or around 90% ? Actually high CPU is not a problem in the IPS. The problem you should worry about is HIGH inspection load what will drop packets but high CPU will not drop packets. I have worked with many IPS and they always have high cpu but that is not a problem you should worry about.
11-24-2011 07:01 AM
Hello,
Thank you for your response.
The case is the i have high CPU(100%) but low inspection load (around 30%).
Any suggestions.
Regards,
11-29-2011 06:04 AM
May you tell what signature indicate such CPU usage?
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: