We have recently upgraded our firepower 8350 to 6.2.3.4 and we have started seeing high CPU instance for SNORT processes and in one of the case we hit major slowness and high traffic drop rates.
We have engaged TAC - almost 3 times now and each engineer has different view and perspectives - but no solutions.
Let me know your advice or things i can look at to hit a cause of this concern. Thanks in advance.
Below is the TOP output -
PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
28140 sfsnort 20 0 5774m 793m 19m R 100 0.7 14:55.14 snort
28124 sfsnort 20 0 5700m 723m 22m R 94 0.6 87:04.21 snort
28151 sfsnort 20 0 5727m 745m 19m R 90 0.7 89:27.20 snort
28142 sfsnort 20 0 5735m 755m 19m R 72 0.7 67:25.98 snort
28126 sfsnort 20 0 5759m 777m 20m R 71 0.7 62:50.92 snort
28134 sfsnort 20 0 5719m 737m 19m R 30 0.7 67:56.34 snort
28125 sfsnort 20 0 5802m 822m 20m S 20 0.7 14:01.81 snort
28150 sfsnort 20 0 5821m 841m 20m S 15 0.7 7:56.11 snort
