cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
7295
Views
0
Helpful
0
Comments
TCC_2
Level 10
Level 10

Core issue

This is the detailed procedure on how to resolve the PIX High CPU Utilization issue.

Resolution

Complete these steps:

  1. You can use the show cpu usage command in order to see what load the PIX is under.

    Note: The output is a running average. The PIX can have higher spikes of CPU usage that are masked by the average.

    Once the PIX reaches 80 percent CPU usage, the latency through the PIX slowly increases until about 90 percent CPU.

    When CPU usage is more than 90 percent, PIX starts to drop packets.

  2. If the CPU usage is high, you can check the processes to see what eats up the CPU time. Issue a show processes command and then use that information to reduce some of the time eaten up by the heavy processes such as logging. You can disable logging on the PIX to decrease the CPU usage.

  3. If the CPU does not run high but packets stil get dropped, check the PIX interface for collisions and issue the show interface command, possibly caused by a duplex mismatch, and check for no buffers. If the no buffer count increments but the CPU usage is not low, then the interface is not able to keep up with the traffic that goes through it.

  4. If the buffers are fine, check the blocks. If the current (CNT) column in the show blocks output is close to 0 on the 1550-byte blocks (16384-byte blocks for 66 MHz Gig cards), then the PIX most likely drops Ethernet packets because it is too busy. In this instance, the CPU also spikes high.

  5. While you experience trouble with the creation of new connections through the PIX, you can check the current count of connections through the PIX with the use of the show conn count command. If the current count is high, check the show memory output to ensure that the PIX does not run out of memory. If memory is low, start to investigate the source of the connections and do a show conn or show local-host command in order to see if the network experiences a denial-of-service attack. This can also mean a virus attack in the network.

  6. Other commands can also be used to measure the amounts of traffic that passes through the PIX. The show traffic command displays the aggregate packets and bytes per interface, and the show perfmon command breaks the traffic down into different types that the PIX inspects.

  7. Another reason for high CPU usage can be due to too many multicast routes. Issue the show mroute command in order to check if PIX/ASA is getting too many multicast routes.

Refer to Monitor and Troubleshoot PIX 500 Performance Issues for more information on how to troubleshoot.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: