IDSM-2 CPU 1 and 2 Usage

[eweigl]

Hello,

I have a question to the understanding of the IDS.

On the Cisco IDM 6.1 home page you can see the usage gauge of two CPUs. CPU1 oscillate between 70% and 90%, while CPU2 is always running on boring 1% !!!

What is the reason for this? Is it possible to share the workload between the CPUs with configuration parameters?

Thanks in advance,

Eckhard

[smahbub]

By default, IDM displays the Sensor Information, Sensor Health, Licensing, Interface Status, Top Applications, and CPU, Memory, & Load gadgets in the Home pane.Can you provide more information about the network setup including the devices used which will make us understand the issue and hepl you better.

[Farrukh Haroon]

The second dial is for the network security health/posture of that sensor. It is based on the highest threat rating of events received in the past 5 minutes.

"Network Security-Displays alert counts and average and maximum threat and risk ratings. The timestamp on the graph is the sensor local time at each snapshot. "

Regards

Farrukh

[eweigl]

Hello Farrukh,

thanks for your answer, but my question applies to the "CPU,Memory,&Load-Sensor" area.

There you see the CPU usage of the two CPUs. The usage is very unequal. What is the reason for this? Have the CPUs to work in loadbalancing? (I couldn't find any documentation about this) If yes, I think I have a problem and I'm going to open a TAC case.

Regards, Eckhard

[Farrukh Haroon]

I'm sorry I could not locate any information about this second CPU field in the documentation. Furthermore it is not even there on the IDSM-2. It could be specific to the 4270. Perhaps that model has two CPUs and Cisco is using only one and as always it could possibiliy be a bug.

I'm sure the experts at Cisco would be in a better position to comment on this.

Regards

Farrukh

[pberis · Accepted solution]

The secondary CPU should remain mostly idle until the primary CPU is saturated. The behaviour you describe is common on systems experiencing less than ~70% load.

[Farrukh Haroon]

Thanks for that info Paul :)

However it would be nice if you could have this added to the IDM documentation. Most people would see such a behavior and get alarmed about it.

Regards

Farrukh