Hi Guys
One of our customer's 5516 with Firepower is suddenly started to have high memory utilization, I can see quite a few snort processes, is this normal?
Hardware: ASA5516, 8192 MB RAM, CPU Atom C2000 series 2416 MHz, 1 CPU (8 cores)
> show memory
total used free shared buffers cached
Mem: 3533024 3249000 284024 0 47468 979544
-/+ buffers/cache: 2221988 1311036
Swap: 3322424 3112776 209648
> show processes
PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
5216 sfsnort 1 -19 1237m 253m 9716 S 8 7.3 5693:29 snort
4609 root 0 -20 0 0 0 S 6 0.0 30183:24 kvm_ivshmem_rxt
5214 sfsnort 1 -19 1238m 247m 9472 S 6 7.2 3508:53 snort
5215 sfsnort 1 -19 1272m 289m 9668 S 4 8.4 3386:08 snort
8 root 20 0 0 0 0 S 2 0.0 444:03.36 rcu_preempt
4555 root 20 0 1177m 2824 708 S 2 0.1 1480:11 diskmanager
5217 root 1 -19 297m 13m 844 S 2 0.4 245:07.98 ids_event_alert
9679 admin 20 0 17428 1348 976 R 2 0.0 0:00.01 top
26705 root 1 -19 159m 1060 792 S 2 0.0 315:51.56 ids_event_proce
1 root 20 0 4220 636 612 S 0 0.0 5:23.95 init
2 root 20 0 0 0 0 S 0 0.0 0:00.22 kthreadd
3 root 20 0 0 0 0 S 0 0.0 7:37.11 ksoftirqd/0
4 root 20 0 0 0 0 S 0 0.0 0:00.00 kworker/0:0
5 root 0 -20 0 0 0 S 0 0.0 0:00.00 kworker/0:0H
7 root RT 0 0 0 0 S 0 0.0 1:06.15 migration/0
9 root 20 0 0 0 0 S 0 0.0 0:00.00 rcu_bh
10 root 20 0 0 0 0 S 0 0.0 0:00.00 rcu_sched
11 root RT 0 0 0 0 S 0 0.0 0:02.72 migration/1
12 root 20 0 0 0 0 S 0 0.0 1:15.07 ksoftirqd/1
13 root 20 0 0 0 0 S 0 0.0 0:00.00 kworker/1:0
14 root 0 -20 0 0 0 S 0 0.0 0:00.00 kworker/1:0H
15 root RT 0 0 0 0 S 0 0.0 0:03.08 migration/2
16 root 20 0 0 0 0 S 0 0.0 1:14.21 ksoftirqd/2
18 root 0 -20 0 0 0 S 0 0.0 0:00.00 kworker/2:0H
19 root RT 0 0 0 0 S 0 0.0 0:03.34 migration/3
20 root 20 0 0 0 0 S 0 0.0 1:07.97 ksoftirqd/3
21 root 20 0 0 0 0 S 0 0.0 0:00.00 kworker/3:0
22 root 0 -20 0 0 0 S 0 0.0 0:00.00 kworker/3:0H
23 root RT 0 0 0 0 S 0 0.0 1:24.89 migration/4
24 root 20 0 0 0 0 S 0 0.0 13:28.47 ksoftirqd/4
26 root 0 -20 0 0 0 S 0 0.0 0:00.00 kworker/4:0H
27 root RT 0 0 0 0 S 0 0.0 1:26.28 migration/5
28 root 20 0 0 0 0 S 0 0.0 13:58.11 ksoftirqd/5
30 root 0 -20 0 0 0 S 0 0.0 0:00.00 kworker/5:0H
31 root 0 -20 0 0 0 S 0 0.0 0:00.00 khelper
32 root 20 0 0 0 0 S 0 0.0 0:00.00 kdevtmpfs
281 root 0 -20 0 0 0 S 0 0.0 0:00.00 writeback
284 root 0 -20 0 0 0 S 0 0.0 0:00.00 bioset
285 root 0 -20 0 0 0 S 0 0.0 0:00.00 crypto
287 root 0 -20 0 0 0 S 0 0.0 0:00.00 kblockd
366 root 0 -20 0 0 0 S 0 0.0 0:00.00 ata_sff
376 root 20 0 0 0 0 S 0 0.0 0:00.00 khubd
383 root 0 -20 0 0 0 S 0 0.0 0:00.00 md
388 root 20 0 0 0 0 S 0 0.0 34:21.83 kworker/0:1
389 root 20 0 0 0 0 S 0 0.0 15:15.82 kworker/1:1
390 root 20 0 0 0 0 S 0 0.0 0:00.00 kworker/2:1
392 root 20 0 0 0 0 S 0 0.0 27:18.00 kworker/4:1
393 root 20 0 0 0 0 S 0 0.0 21:26.30 kworker/5:1
487 root 0 -20 0 0 0 S 0 0.0 0:00.00 rpciod
512 root 20 0 0 0 0 S 0 0.0 92:25.40 kswapd0
513 root 20 0 0 0 0 S 0 0.0 0:00.22 fsnotify_mark
514 root 0 -20 0 0 0 S 0 0.0 0:00.00 nfsiod
638 root 0 -20 0 0 0 S 0 0.0 0:00.00 iscsi_eh
658 root 20 0 0 0 0 S 0 0.0 0:00.00 scsi_eh_0
661 root 20 0 0 0 0 S 0 0.0 0:00.01 scsi_eh_1
683 root 20 0 0 0 0 S 0 0.0 20:10.95 kworker/2:2
689 root 0 -20 0 0 0 S 0 0.0 0:00.00 kpsmoused
734 root 0 -20 0 0 0 S 0 0.0 0:00.00 deferwq
751 root 20 0 0 0 0 S 0 0.0 0:00.00 kworker/4:2
760 root 0 -20 0 0 0 S 0 0.0 3:21.86 kworker/3:1H
761 root 0 -20 0 0 0 S 0 0.0 4:25.51 kworker/4:1H
762 root 0 -20 0 0 0 S 0 0.0 3:51.74 kworker/5:1H
763 root 0 -20 0 0 0 S 0 0.0 4:15.02 kworker/1:1H
764 root 0 -20 0 0 0 S 0 0.0 3:44.51 kworker/2:1H
765 root 20 0 0 0 0 S 0 0.0 6:31.63 kjournald
791 root 16 -4 12820 396 392 S 0 0.0 0:00.28 udevd
1052 root 20 0 0 0 0 S 0 0.0 10:18.95 kworker/3:2
1313 root 0 -20 0 0 0 S 0 0.0 31:36.87 kworker/0:1H
1459 root 20 0 0 0 0 S 0 0.0 0:00.00 kjournald
1460 root 20 0 0 0 0 S 0 0.0 137:34.95 kjournald
2459 root 20 0 0 0 0 S 0 0.0 0:00.00 kworker/5:2
2710 root 20 0 37012 200 168 S 0 0.0 0:00.00 syslog-ng
2711 root 20 0 459m 3272 1908 S 0 0.1 20:00.24 syslog-ng
2734 root 20 0 19784 648 576 S 0 0.0 2:32.67 crond
3188 bin 20 0 4204 332 328 S 0 0.0 0:00.00 rpc.portmap
3191 root 20 0 8432 468 464 S 0 0.0 0:00.00 rpc.statd
3293 root 20 0 35060 540 432 S 0 0.0 0:00.04 sshd
3456 root 20 0 20160 668 616 S 0 0.0 0:00.01 xinetd
3466 root 20 0 4236 436 432 S 0 0.0 0:00.00 acpid
4512 root 20 0 22552 604 600 S 0 0.0 0:00.03 agetty
4513 root 20 0 22552 604 600 S 0 0.0 0:00.00 agetty
4514 root 20 0 12652 580 576 S 0 0.0 0:00.00 agetty
4516 root 20 0 8016 1908 824 S 0 0.1 231:00.00 pmmon.sh
4527 root 20 0 64196 3444 820 S 0 0.1 721:59.72 pm
4538 mysql 20 0 3481m 190m 4864 S 0 5.5 13008:00 mysqld
4544 root 20 0 5032 160 120 S 0 0.0 2:22.30 sfmb
4545 root 20 0 52456 2028 1760 S 0 0.1 2:19.06 ntpd.pl
4546 root 20 0 42896 8116 1992 S 0 0.2 33:09.34 rotate_stats.pl
4547 root 20 0 313m 804 728 S 0 0.0 73:22.69 cardmanager
4549 root 20 0 5396 252 248 S 0 0.0 0:00.29 SFNotificationd
4550 root 20 0 17436 1080 800 S 0 0.0 103:36.18 top
4551 root 20 0 36592 512 484 S 0 0.0 25:55.79 detectionhealth
4552 root 20 0 8788 180 176 S 0 0.0 0:00.00 rrd_server
4554 root 20 0 171m 624 624 S 0 0.0 45:41.35 sfhassd
4556 root 20 0 2494m 632 620 S 0 0.0 1952:46 adi
4557 sfsnort 20 0 104m 628 628 S 0 0.0 14:55.14 bltd
4558 root 20 0 42804 6192 1684 S 0 0.2 51:57.11 uimp.pl
4559 www 20 0 12940 416 416 S 0 0.0 0:00.31 hm_notifyd
4560 root 20 0 355m 2824 2196 S 0 0.1 1197:51 CloudAgent
4561 root 20 0 70116 656 656 S 0 0.0 9383:34 UEChanneld
4562 root 20 0 3385m 158m 1592 S 0 4.6 57042:46 java
4563 root 20 0 179m 2876 1768 S 0 0.1 224:24.58 mojo_server_wra
4564 www 20 0 325m 456 428 S 0 0.0 19:54.43 memcached
4568 root 1 -19 26224 612 600 S 0 0.0 13:47.35 bridged
4618 root 20 0 97.9m 360 328 S 0 0.0 0:00.00 diskmanager
4619 root 20 0 17192 1460 1460 S 0 0.0 0:00.71 diskmgr_handler
4683 root 20 0 385m 340 296 S 0 0.0 0:00.00 diskmanager
4684 root 20 0 17196 1460 1460 S 0 0.0 0:00.72 diskmgr_handler
4738 root 20 0 51392 976 832 S 0 0.0 80:57.53 fpcollect
4740 root 20 0 260m 202m 1912 S 0 5.9 15272:37 Pruner.pl
4741 root 20 0 480m 54m 1972 S 0 1.6 147:53.25 ActionQueueScra
4742 root 20 0 13696 596 492 S 0 0.0 96:53.06 ui_archiver
4746 root 20 0 3719m 14m 548 S 0 0.4 3453:59 SFDataCorrelato
4747 root 20 0 39816 6244 1760 S 0 0.2 894:00.74 expire-session.
4748 root 20 0 36660 4448 1836 S 0 0.1 129:06.39 TSS_Daemon.pl
4749 root 20 0 40352 2016 1528 S 0 0.1 3:18.70 snapshot_manage
4917 root 20 0 25756 1136 980 S 0 0.0 36:39.00 ntpd
5055 root 20 0 160m 41m 2252 S 0 1.2 64:22.88 ASAConfig.pl
7387 www 20 0 355m 107m 4276 S 0 3.1 77:23.96 mojo_server_wra
8603 www 20 0 46004 4672 2552 S 0 0.1 0:00.21 httpsd
8725 www 20 0 46324 5316 2796 S 0 0.2 0:00.15 httpsd
9383 www 20 0 45868 3072 1068 S 0 0.1 0:00.00 httpsd
9654 root 20 0 26116 1044 884 S 0 0.0 0:00.00 telnetd
9656 root 20 0 50224 1464 1156 S 0 0.0 0:00.02 login
9665 admin 20 0 109m 3192 1596 S 0 0.1 0:00.06 clish
9674 root 20 0 4216 340 272 S 0 0.0 0:00.00 sleep
9676 admin 20 0 7484 1324 900 S 0 0.0 0:00.00 sh
9677 admin 20 0 8628 6176 1900 S 0 0.2 0:00.19 sfcli.pl
9678 admin 20 0 6648 780 628 S 0 0.0 0:00.00 more
11551 root 20 0 0 0 0 S 0 0.0 0:00.00 kworker/u12:2
11727 www 20 0 254m 110m 5212 S 0 3.2 65:24.96 mojo_server_wra
13942 root 20 0 50224 720 716 S 0 0.0 0:00.03 login
13994 admin 20 0 109m 672 672 S 0 0.0 0:00.14 clish
14053 root 20 0 0 0 0 S 0 0.0 8:09.29 kworker/u12:0
18800 root 20 0 45868 4636 2640 S 0 0.1 0:01.12 httpsd
18804 www 20 0 46152 5176 2856 S 0 0.1 0:00.33 httpsd
18805 www 20 0 46460 5156 2792 S 0 0.1 0:00.31 httpsd
18806 www 20 0 46500 5500 2896 S 0 0.2 0:00.30 httpsd
18807 www 20 0 46160 5200 2844 S 0 0.1 0:00.28 httpsd
18808 www 20 0 46144 5092 2792 S 0 0.1 0:00.24 httpsd
18832 nobody 20 0 451m 996 736 S 0 0.0 0:01.07 nscd
26306 root 20 0 82512 63m 3220 S 0 1.8 28:33.05 Syncd.pl
26819 root 20 0 27524 2168 1524 S 0 0.1 59:40.51 snmpd
31350 www 20 0 46324 5332 2824 S 0 0.2 0:00.27 httpsd
CCNA R&S
