ASA 5506 9.6(1) high CPU usage 100% (99.6% DATAPATH-0-1723)

[BiolodjiSou]

Hello team 

i have deployed new Firewall 5506 9.6(1) in my network , the traffic Up/Down is not so high (less 100Mb/s) , but just few hours after migration traffic to this new firewall , i noticed high CPU usage :

show cpu usage

CPU utilization for 5 seconds = 100%; 1 minute: 100%; 5 minutes: 100%

show processes cpu-usage sorted non-zero 

PC Thread 5Sec 1Min 5Min Process
- - 99.5% 99.6% 99.6% DATAPATH-0-1723
0x00007f01e4dedfbb 0x00007f01cafd2680 0.2% 0.1% 0.1% ssh
0x00007f01e4e2e7be 0x00007f01cb0cc4e0 0.1% 0.1% 0.1% Logger
0x00007f01e398c0f2 0x00007f01cb0bd940 0.1% 0.1% 0.1% CP Processing

Please can someone support in this issue ? (even ASDM access is too slow and sometimes doesnt work )

[Akhil.Balachandran]

Hi BiolodjiSou

The issue should be traffic related. Is high CPU noticed at a particular time of the day or is it constantly at 100% ?  what is the traffic profile like?

What is the connection count on this ASA ? Run the command "show conn count ".  How many interfaces are passing traffic ?

Regards

Akhil

[romarroca1234]

Hi,

Was this solved already? I also have this issue and from the bug search it says to disable threat detection by :

no threat-detection basic-threat
no threat-detection statistics

after entering this command my CPU-USAGE gradually drops to almost 5% usage to 10% but out of nowhere the threat-detection commands keep enabling by themselves without user interaction and clogs again the cpu-usage upto 86%.

Im also using 5506-X version 9.6.1 with ASA firepower services running version 6.1.0

Please Help,

regards,

Romar

[zch1]

2 years later, but I ran into a similar problem running version 9.8(2).  Disabling threat-detection only solved the problem temporarily.  I upgraded to 9.9(2) and it has been stable averaging 15% for about 24 hours so far, with a peak of 25% during peak business hours.   HTH for anyone else who may be still dealing with this.

[Marvin Rhoads]

If you are using the FirePOWER service module, 100 Mbps is right around the maximum expected throughput for a 5506-X.

[BiolodjiSou]

hi marvin , yes i am using FirePower but still my traffic less than 30Mb. my issue was resolved after rebooting the firewall but still i am not getting what was the issue exactly ! since tow days , CPU usage looks normal

[nanjidjamts]

no threat-detection basic-threat
no threat-detection statistics

Not solved after entering this command

[Marius Gunnerud]

How many access rules do you have configured?  I have seen a similar issue with FTD1010 where the issue was related to the number of access rules configured.  Keep in mind that you need to use show access-list command and not show running-config as object groups that contain several subnets or IPs are expanded when the ASA is looking for a match.