FMC - device CPU monitoring

[plwalsh]

I use FMC to monitor a HA pair of 2140s with FTD 6.2.3.3. I sometimes receive alerts for high CPU

e.g.

Health Monitor Alert from XXXX (mgmt ip of 2140 device)

Time: Mon Sep 10 09:23:48 2018 UTC

Severity: critical

Module: CPU Usage

Description: Using CPU27 92.96%

yet when I CLI onto the 2140 and issue 'show cpu core' there is no reference to CPU27. Core 0 to Core 15 are listed. So what CPU is FMC monitoring? Are occasional high CPU alerts acceptable/normal?

[mikael.lahtela]

Hi,

Occasional CPU spikes are nothing to worry about, can be a big file that is downloaded through the 2140.
You could try go into the 2140 cli expert mode, run top and press key 1 to see all cores live.

br, Micke

[plwalsh]

Thanks Micke.

That is useful to know. I'm still not clear on the hardware the FMC health monitor CPU task is checking on my 2140 devices.

The processors of the 2140 are listed here:

https://www.cisco.com/c/en/us/td/docs/security/firepower/2100/hw/guide/b_install_guide_2100/overview.html#concept_djc_gns_1cb

A single x86 with 16 cores - so I guess the status of this may be checked with 'show cpu core' from the 2140 CLI.

A single Cavium with 16 cores - I dont think this does a whole lot in 6.2.3.3 unless one runs VPN.

The graph of device CPU in FMC has 32 CPUs and its trend bears no resemblance to the ouput of 'show cpu core'.

Can anyone tell me if snort on the 2140 with FTD image runs on dedicated cpu/RAM or does it use the same cpu/RAM as the lina(ASA) element? Can anyone tell me hwo one sees the status of the Cavium from the FTD CLI?

Regards,

Piaras

[mikael.lahtela · Accepted solution]

Hi,

The Cavium chip is used for crypto offloading, L2-L4 fastpath traffic offloading and should be used for TLS offloading in 6.2.3.x, not sure how much it's used yet.
Haven't found a way to look at Cavium usage, but sounds like your event is from the Cavium chip.

br, Micke