FWSM hight cpu utilization

[ricky.eng]

My FWSM is having high cpu utilization and only happen in the morning around 8am-9am. From the show process, I can tell the fixup feature is occupying the highest runtime. Question is ... is there any show command to tell which particular fixup feature is using the most?

[Marcin Latosiewicz]

show perfmon 
show service-policy
show np 3 stats | i FIX 

Could be useful (not syntax checked).

Due to the way FWSM's hardware architecure is designed typical fixups (ICMP,TCP,UDP) should be done on NP3 and not in CPU.

Can I suggest opening a TAC case. TAC will collect:

- CPU profiler

- show proc a few times

(others)

And will tell you exectly what's going on.

[ricky.eng]

Thanks Marcin,

I understand the three NP...What I notices is all three NP block threshold are hit and base on Cisco documentation, it said the FWSM is oversubsribed.

# sh np block

                 MAX   FREE   THRESH_0   THRESH_1   THRESH_2

NP1 (ingress)  32768  32768         17        899      36385

    (egress)  521206 521206          0          0          0

NP2 (ingress)  32768  32768         41       1344      41968

    (egress)  521206 521206          0          0          0

NP3 (ingress)  32768  32768         99       5519      34275

    (egress)  521206 521206          0          0          0

If I go TAC, they probably will conclude the firewall is oversubsribed and require hardware upgrade and increase of capacity.

So, I am more interested to find out exactly what traffic causing the CPU statistis to go up but limited to know that the top run time is the fixup.

So, my next step is to find out which interface is the most congested so that I can SPAN the traffic to Sniffer/Ethereal for more detail traffic analysis. However, base on many of the #show traffic output gathered during CPU went high/down, the pkts/s counter didn't really fluactuate according to CPU.

[Marcin Latosiewicz]

Give the guys in TAC some credit :-)

Oversubscription might be contributing to your CPU problemem, but ...

Consider that traffic should not hit the CPU on FWSM unless it's inspected/IPv6 (and several other conditions).

From the looks of it, the box is not that oversubscribed ... thr 0 was only reached a few times doublesigits don't indicte a heavy oversubscription.

show perfmon

and

show service-policy

is where you should start  ;-)

M.

[sumani1984]

diasble syslog and check once