Issue: IDSM is showing 100% Inspection(Sensor) Load during certain periods daily which causes more than 2000 ms delay in the network.This issue occurs after upgrading the signature engine to E3
We have also monitored the traffic during 100% Load on PRTG but traffic has still in normal utilization 40 to 50Mb.
I have found the same 100% Load issue on the Cisco TAC case.
Has any one faced this issue before in their workaround. Actually we are not sure about our issue. Is our issue also related to SMTP traffic or not as in the TAC case.
How can we identify our issue?
Please see the following TAC case:
IDSM is showing high CPU and a "processing load percentage" of 100 during certain periods daily. Traffic is affected at those times.
Issue has been identified to be linked to smtp traffic.
How can we solve/identify this issue?
Please provide us the appropriate solution for this issue.
Here are the details of IDSM-2:
Our IDSM is in Inline VLAN-Pair Mode:
Inline TCP Tracking Mode: Interface and VLAN
Core Switch IPS Etherchannel Setup:
Group 5: IDSM(A) and IDSM(B) Port x/7
Group 6: IDSM(A) and IDSM(B) Port x/8
Some VLAN Pair(s) are on interface x/7 and others are on x/8
There is an FWSM module also, which acts as the default gateway for all internal VLANs.
All signatures are in default state.
IPS1 version Detail:
Cisco Intrusion Prevention System, Version 6.1(2)E3
Signature Update S440.0
Cisco6513 IOS: Version 12.2(18)SXF17
Thanks in advance.