Firepower: High CPU usage

[jds5]

Hello,

We have observed a 100% CPU consumption on our firewall, FP2130 having caused side effects on production (loss of telephone connections among others...). Today everything seems to be stabilized.
I would like to know what caused it.

You will find attached the graph of the CPU on this FTD

BR,

José

[Asmat Sulaiman]

Hi,

Have you checked the interface stat for errors?

 "show interface | include error"

Have you checked if there was any capture running. Even if they are paused, they still consume cpu cycles, you will have to remove the capture if that is running. 

Also, I would check "show resource usage all" to check if there was any resources exceeded it's limit such as connection limit etc. This will give you some indication including DDOS attack, if you have SNMP monitoring tool, look at the stats during incident.  Hope this help. 

[jds5]

Thank you for your reply

No errors on the interfaces.

However,on one of the interfaces, Internal-Data0/1, I have these values ​​that are observed but I don't know what they correspond to exactly:
Here are some examples:

Queue Stats:

RX[00]: Packets: 12285960171 Bytes: 7815067923166
Blocks free curr/low: 4000/478
RX[01]: Packets: 12466592304 Bytes: 7906529868331
Blocks free curr/low: 4000/0
RX[02]: Packets: 12054322148 Bytes: 7631648842389

Otherwise, there is no capture in progress or pending. The problem occurs very randomly.

------------------ show resource usage counter all 1 ------------------

Resource         Current        Peak         Limit         Denied Context
SSH Server      1                 4                 5            0 System
ASDM              0                 2                30           0 System
Syslogs [rate] 2866          39057         N/A           0 System
Conns           33797       60363      2000000            0 System
Xlates              99              184           N/A            0 System
Hosts             7175           8568         N/A             0 System
Conns [rate] 799                11820       N/A            0 System
Inspects [rate] 481             9921         N/A            0 System
Routes          2706              3284    unlimited         0 System

[jds5]

Hello,

This problem had been resolved for about a month. Unfortunately, it has reappeared.

It could be legitimate traffic increasing the CPU load!

Do you know how to determine the root cause of this random problem?

We're in version 9.20(2)2

Best Regards,