High CPU Utilization on ASA 5520 Version 9.1(6)

mrgiridangi1 · ‎04-13-2015

Hello,

i got an cpu is high issue in my asa firewall 5520 version 9.1(6).

FW# sh xlate count
1051 in use, 17216 most used

fw# sh cpu detailed

Break down of per-core data path versus control point cpu usage:
Core 5 sec 1 min 5 min
Core 0 95.0 (0.0 + 95.0) 95.0 (0.0 + 95.0) 95.0 (0.0 + 95.0)

Current control point elapsed versus the maximum control point elapsed for:
5 seconds = 99.0%; 1 minute: 99.8%; 5 minutes: 100.0%

CPU utilization of external processes for:
5 seconds = 0.2%; 1 minute: 0.0%; 5 minutes: 0.0%

Total CPU utilization for:
5 seconds = 95.2%; 1 minute: 95.1%; 5 minutes: 95.0%

FW# sh processes cpu-usage non-zero sorted
PC Thread 5Sec 1Min 5Min Process
0x0829bc38 0x6edd4e74 91.8% 91.9% 92.0% Dispatch Unit
0x0914652c 0x6edcb230 2.7% 2.8% 2.8% Logger
0x090f9bdd 0x6edb97a0 0.2% 0.1% 0.0% ssh
0x087bf1ee 0x6edc04cc 0.2% 0.2% 0.2% ARP Thread

please help me to resolve this issue

Thank you,

Giri dangi

Vibhor Amrodia · ‎04-15-2015

Hi,

Please provide me the show traffic output ? Also , show tech would be helpful at the time of High CPU.

Thanks and Regards,

Vibhor Amrodia

mrgiridangi1 · ‎04-15-2015

FW# sh traffic
outside:
received (in 1706663.260 secs):
1142976329 packets 433879952912 bytes
0 pkts/sec 254000 bytes/sec
transmitted (in 1706663.260 secs):
1268530227 packets 986991018742 bytes
0 pkts/sec 578001 bytes/sec
1 minute input rate 476 pkts/sec, 109650 bytes/sec
1 minute output rate 596 pkts/sec, 472414 bytes/sec
1 minute drop rate, 8 pkts/sec
5 minute input rate 467 pkts/sec, 109938 bytes/sec
5 minute output rate 615 pkts/sec, 581149 bytes/sec
5 minute drop rate, 12 pkts/sec
inside:
received (in 1706663.250 secs):
17994957293 packets 8958357276132 bytes
10000 pkts/sec 5249000 bytes/sec
transmitted (in 1706663.250 secs):
29282351782 packets 27786746612833 bytes
17001 pkts/sec 16281002 bytes/sec
1 minute input rate 14246 pkts/sec, 7473098 bytes/sec
1 minute output rate 26757 pkts/sec, 29798221 bytes/sec
1 minute drop rate, 8 pkts/sec
5 minute input rate 13879 pkts/sec, 6501578 bytes/sec
5 minute output rate 26565 pkts/sec, 30020906 bytes/sec
5 minute drop rate, 9 pkts/sec
websvcs:
received (in 1706664.380 secs):
29257615811 packets 28411980196461 bytes
17002 pkts/sec 16647000 bytes/sec
transmitted (in 1706664.380 secs):
18999910687 packets 9302745831226 bytes
11001 pkts/sec 5450001 bytes/sec
1 minute input rate 26583 pkts/sec, 30051675 bytes/sec
1 minute output rate 15165 pkts/sec, 7563136 bytes/sec
1 minute drop rate, 20 pkts/sec
5 minute input rate 26406 pkts/sec, 30385932 bytes/sec
5 minute output rate 14812 pkts/sec, 6586208 bytes/sec
5 minute drop rate, 36 pkts/sec
dmz:
received (in 1706664.370 secs):
15014356 packets 3555144226 bytes
1 pkts/sec 2000 bytes/sec
transmitted (in 1706664.370 secs):
18913661 packets 13003848934 bytes
1 pkts/sec 7000 bytes/sec
1 minute input rate 12 pkts/sec, 2621 bytes/sec
1 minute output rate 16 pkts/sec, 12810 bytes/sec
1 minute drop rate, 0 pkts/sec
5 minute input rate 9 pkts/sec, 1313 bytes/sec
5 minute output rate 15 pkts/sec, 14023 bytes/sec
5 minute drop rate, 0 pkts/sec
CMS:
received (in 1706714.960 secs):
3555103 packets 423046514 bytes
2 pkts/sec 1 bytes/sec
transmitted (in 1706714.960 secs):
36989901 packets 9204525176 bytes
1 pkts/sec 5000 bytes/sec
1 minute input rate 2 pkts/sec, 363 bytes/sec
1 minute output rate 13 pkts/sec, 2937 bytes/sec
1 minute drop rate, 0 pkts/sec
5 minute input rate 3 pkts/sec, 439 bytes/sec
5 minute output rate 13 pkts/sec, 2867 bytes/sec
5 minute drop rate, 0 pkts/sec
failover:
received (in 1706668.930 secs):
2752247 packets 225723254 bytes
1 pkts/sec 1 bytes/sec
transmitted (in 1706668.930 secs):
299216953 packets 345160005498 bytes
1 pkts/sec 202000 bytes/sec
1 minute input rate 1 pkts/sec, 120 bytes/sec
1 minute output rate 185 pkts/sec, 208309 bytes/sec
1 minute drop rate, 0 pkts/sec
5 minute input rate 1 pkts/sec, 118 bytes/sec
5 minute output rate 182 pkts/sec, 205575 bytes/sec
5 minute drop rate, 0 pkts/sec

----------------------------------------
Aggregated Traffic on Physical Interface
----------------------------------------
GigabitEthernet0/0:
received (in 1706718.020 secs):
1142987271 packets 456643285944 bytes
0 pkts/sec 267000 bytes/sec
transmitted (in 1706718.020 secs):
1268427576 packets 1010518455246 bytes
0 pkts/sec 592002 bytes/sec
1 minute input rate 476 pkts/sec, 119281 bytes/sec
1 minute output rate 596 pkts/sec, 483088 bytes/sec
1 minute drop rate, 0 pkts/sec
5 minute input rate 467 pkts/sec, 119110 bytes/sec
5 minute output rate 615 pkts/sec, 592318 bytes/sec
5 minute drop rate, 0 pkts/sec
GigabitEthernet0/1:
received (in 1706718.050 secs):
17995152458 packets 9320161344093 bytes
10000 pkts/sec 5460001 bytes/sec
transmitted (in 1706718.050 secs):
29282394737 packets 28334667305681 bytes
17001 pkts/sec 16601001 bytes/sec
1 minute input rate 15291 pkts/sec, 8454558 bytes/sec
1 minute output rate 26331 pkts/sec, 29243648 bytes/sec
1 minute drop rate, 0 pkts/sec
5 minute input rate 13879 pkts/sec, 6793026 bytes/sec
5 minute output rate 26564 pkts/sec, 30509352 bytes/sec
5 minute drop rate, 0 pkts/sec
GigabitEthernet0/2:
received (in 1706734.540 secs):
29258391265 packets 28960987609872 bytes
17001 pkts/sec 16968002 bytes/sec
transmitted (in 1706734.540 secs):
19000113303 packets 9684550989088 bytes
11001 pkts/sec 5674001 bytes/sec
1 minute input rate 26337 pkts/sec, 29563739 bytes/sec
1 minute output rate 16206 pkts/sec, 8563970 bytes/sec
1 minute drop rate, 0 pkts/sec
5 minute input rate 26404 pkts/sec, 30871997 bytes/sec
5 minute output rate 14813 pkts/sec, 6895033 bytes/sec
5 minute drop rate, 0 pkts/sec
GigabitEthernet0/3:
received (in 1706734.570 secs):
2752706 packets 276383084 bytes
1 pkts/sec 0 bytes/sec
transmitted (in 1706734.570 secs):
299221022 packets 350550105092 bytes
1 pkts/sec 205002 bytes/sec
1 minute input rate 1 pkts/sec, 147 bytes/sec
1 minute output rate 183 pkts/sec, 210810 bytes/sec
1 minute drop rate, 0 pkts/sec
5 minute input rate 1 pkts/sec, 147 bytes/sec
5 minute output rate 182 pkts/sec, 208868 bytes/sec
5 minute drop rate, 0 pkts/sec
Internal-Control0/0:
received (in 1706737.930 secs):
3463948 packets 251239714 bytes
2 pkts/sec 1 bytes/sec
transmitted (in 1706737.930 secs):
3890225 packets 278413661 bytes
2 pkts/sec 2 bytes/sec
1 minute input rate 2 pkts/sec, 150 bytes/sec
1 minute output rate 2 pkts/sec, 166 bytes/sec
1 minute drop rate, 0 pkts/sec
5 minute input rate 1 pkts/sec, 146 bytes/sec
5 minute output rate 2 pkts/sec, 162 bytes/sec
5 minute drop rate, 0 pkts/sec
Internal-Data0/0:
received (in 1706738.990 secs):
31000966962 packets 24938616789453 bytes
18000 pkts/sec 14611001 bytes/sec
transmitted (in 1706738.990 secs):
48334646869 packets 41070708845789 bytes
28000 pkts/sec 24063000 bytes/sec
1 minute input rate 15366 pkts/sec, 14038303 bytes/sec
1 minute output rate 42544 pkts/sec, 40230593 bytes/sec
1 minute drop rate, 0 pkts/sec
5 minute input rate 14769 pkts/sec, 13830434 bytes/sec
5 minute output rate 41184 pkts/sec, 39803288 bytes/sec
5 minute drop rate, 0 pkts/sec
Management0/0:
received (in 1706739.020 secs):
18563807 packets 4292150406 bytes
0 pkts/sec 2001 bytes/sec
transmitted (in 1706739.020 secs):
55888372 packets 23183892540 bytes
0 pkts/sec 13002 bytes/sec
1 minute input rate 16 pkts/sec, 2484 bytes/sec
1 minute output rate 33 pkts/sec, 15017 bytes/sec
1 minute drop rate, 0 pkts/sec
5 minute input rate 13 pkts/sec, 1984 bytes/sec
5 minute output rate 28 pkts/sec, 17343 bytes/sec
5 minute drop rate, 0 pkts/sec

Pranay Prasoon · ‎04-15-2015

hi,

The aggregate traffic/s is not that high. Total connection is not that high as well.

However seems websvcs interface has high traffic compare to other interface.

If you have ASDM can you please check its log, do you see some unusual message?

if yes, please post here. It might be a traffic loop or some DOS message?

Also make sure you don't have http inspection enabled.

Thanks

mrgiridangi1 · ‎04-16-2015

thank you pranay