ASA on Firepower 2140 - High CPU usage

[NetworkNinjaAC]

We are seeing a high CPU usage on our network firewall. Does anyone know what the DataPath process is for?

[marce1000]

 - FYI : https://community.cisco.com/t5/network-security/commands-for-troubleshooting-high-cpu/m-p/4573402#M1088424

 M.

[balaji.bandi]

what kind of traffic this FW handling?

[NetworkNinjaAC]

It sits at the perimeter of the network so all traffic traverses through it.

[balaji.bandi]

what kind of traffic this FW handling?   - i mean bandwidth wise, ? post interface output how much utilization.

[NetworkNinjaAC]

oh ok sorry for misunderstanding, this was this morning with low traffic and cpu at 50%:

[tvotna]

Processes CPU usage is not normal, because it is displayed incorrectly in this version due to CSCvt15348. Actually, it is very high in datapath. This can be caused by high pps rate or high drop rate, so you need to collect "clear traffic" / "show traffic" (once, but wait 1 minute after clearing) and "clear asp drop" / "show clock" + "show asp drop" (thrice) (to see how drops increase over time).

You're running out of 1550B and 80B blocks. The former can be attributed to high CPU. The latter is a bug. Do you encrypt failover link with IPsec? Provide "show run failover".

Conn rate, ACL size, number of xlates is small for this platform.

[MHM Cisco World]

Datapath sometimes is big problem. 

Usually Datapath is for VPN (s2s or anyconnect). 

If you can open TAC with cisco it better and fast way to know why these processes utilize your FW CPU.