CPU high on ASA - Dispatch Unit

Andy White · ‎12-11-2013

Hello,

Our ASA 5520 seems to hit around 80% at certain times of the day. I know 80% is the marker for when I shoudl start to investigate. I have notice that it is the dispatch unit:

0x0828fb01 0x6d5c3278 85.8% 85.9% 73.3% Dispatch Unit

What steps should I take next?

The ASA is on 9.1.3.

Thanks

Julio Carvajal · ‎12-11-2013

Hello Andy,

Then you will determine if this is the expected amount of traffic or if there is some traffic burst in the network.

Commands that I recommend for troubleshooting a high CPU issue

clear interface

show interface | include errors

and 5 minute later again

show interface | include errors

If we see a huge amount of overruns, underruns we might be dealing with bursty traffic.

Then use the command

show local-host | include host|count\;limit

Then look for IP addresses with a huge amount of connections

Do a show conn and look for connections with a huge amount of bits being transfered or being held on the ASA connection table.

Create captures on the affected interface to see what traffic is being seeing the most on the ASA.

Rate all of the helpful posts!!!

Regards,

Jcarvaja

Follow me on http://laguiadelnetworking.com

Julio Carvajal
Senior Network Security and Core Specialist
CCIE #42930, 2xCCNP, JNCIP-SEC

Andy White · ‎12-11-2013

Thanks.

The

show interface | include errors looks ok over 5-10 mins.

When I run the other commands there is so many pages as we have many sub interfaces., is there are way to sort so the largest is at the top? I guess I can export and put into Excel.

show local-host | include host|count\;limit seems to show zeros everthing.

Part of the output.

local host: <192.168.28.173>,