ISE 2.1 CPU Utilization 90%

[Ali]

Hi Community,

We are currently running with ISE 2.1 patch 2,4 on SNS-3515-k9 

our CPU utilization is going around 90% constantly, when i checked CPU Statistic in CLI its shows Database Server is occupying around 165 processes and containing 8.9 CPU utilization.

Due to this issue not able to login GUI access sometime.

How to resolve the issue does or any one face this issue.

Helpful reply would be highly appreciative.

Thanks

[abhishek.marat1]

We had this issue with ISE 2.2 patch 3. We had about 2 TAC cases open. The TAC engineer after some digging pointed that it is bug and was resolved in the next patch. So we patched our ISE servers to patch 5 and that resolved the issue. We haven't seen CPU spikes ever since then. I would recommend opening a TAC case if possible and ask the TAC engineer if this is caused by a bug (sometimes the BUG ID is not available publicly and is only seen by the TAC engineers). If this cannot be done, i would patch the ISE servers to the latest patch. Please read release notes for that patch version and what issues it resolves before doing so.

P.S. Please rate helpful posts. Thank you!

[Ali]

Hi Abhishek,

Thanks for your reply and information.
Currently we are getting the CPU hike on daily basis, so had to open a case and TAC is working on the issue.
I have read few docs and found most cases its the bug that causes the hike so option is to get the patch.
we are waiting for the update from TAC, once we get an update we go for the next step.

[soumbis12 · Accepted solution]

Hi Community,

• CSCvc86247 High CPU caused by "infinite loop" threads on PSN
• CSCvc75209 ISE 2.1 and above shows High IO and High CPU usage for oracle process on MNT mode.
• CSCvd56372 ISE displays Dead lock in oracle alert log.
  ORA-00060: Deadlock detected. See Note 60.1 at My Oracle Support for Troubleshooting ORA-60 Errors. More info in file /opt/oracle/base/diag/rdbms/cpm10/cpm10/trace/cpm10_j001_25964.trc
• EDF_LOG is large which can cause backups to fail and disk space issue

In addition to bugs, configuration that might add to CPU load:

• The Endpoint Attribute Filter check box is not checked and should be. When the EndPoint attribute filter is not enabled, ISE can suffer performance issues when too much un-needed profiler data is being used. Go to ADMINISTRATION > SETTINGS > PROFILING and check "Enabled" on the EndPoint Attribute Filter Checkbox
• Logging Suppression protects Identity Services Engine from misconfigured endpoints by no logging un-needed RADIUS Authentication and Accounting packets, it is recommended to keep logging suppression enabled at all times. Suppression should be enabled under Administration -> System -> Settings -> Protocols -> RADIUS
• Logging Suppression prevents the Monitoring and Troubleshooting node from being overwhelmed with repeated successful authentications, adding a repeat count instead of another full record. Suppression should be enabled under Administration -> System -> Settings -> Protocols -> RADIUS

All above mentioned bugs are resolved in latest patch. To resolve all issues that are causing high CPU you should install latest patch, however to resolve bugs that I was able to verify you are hitting you can install patch 5.