cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1946
Views
0
Helpful
7
Replies

C600 CPU Load TOO HIGH (100%)

buzz_ironport
Level 1
Level 1

Hi there

we have a cluster of x 2 C600 machines (version 6.5.0-405)
since 5-6 days we have a 99% to 100% CPU Load , but Ram utilization is
just 7%

Messages in Workqueue are also not to high

The count on incoming messages and even REJECTED's are also
just the same of even less as all the days before.

Has anyone an Idea what can be the reason of the High CPU Load ??


THX in advance

7 Replies 7

prash_ironport
Level 1
Level 1

Hello,

Have you tried restarting the appliances? It could be some process went awry.
Also, so check if the automatic antispam update is not disabled.

Hope this helps.

Regards,

buzz_ironport
Level 1
Level 1

yes, automatic Antispam Update is activated

Here is the last Update :

Structural Rules (2.7.0-102-20090215_144905)
Content Rules (20090216_102009)
Content Rules Update (20090216_102303 )

take a look at the CPU-Utilization Below:

CPU Utilization
Email Security Appliance: 7.0%
Anti-Spam: 87.0%
Anti-Virus: 3.0%
Reporting: 0.0%
Quarantine: 0.0%
Total CPU Utilization: 100.0%


It seems to me that Antispam Engine is pretty busy
but WHY 24 Hours ?


I think i must take a look at the Filters (MSG & Content)

-----

kyerramr
Level 1
Level 1

I would suggest verifying the config unless something has changed in the past few days. Do you have the policies set to scan SPAM for both inbound and outbound?

Also verify the max_scan_size (for IPAS, if used) is set higher than 130k is set higher than 130K (suggested value).

buzz_ironport
Level 1
Level 1

Anti Spam scanning is only configured for Incoming Policies,

max scan size for IPAS is also set to 130K

--
We still have this high load of 100% on each machine
and Anti Spam is stil busy with more than 80%


@kyerramr:
you'r right its all about Anti Spam Engine

Hi,
I recommend that you open a support ticket and have them look at the queues, Possibility of a message stuck in the queue causing processing issues.

Folks,

C600 machines and AsyncOS version 6.5.0-405 are no longer supported. I see this thread did start in 2009 and there was a recommendation, at that time, to open a ticket with support.

Hi CPU utilization could be related to IPAS engine/updates/corruption but also to a variety of other issues, for instance, high mail flow, large messages and expensive regex used with filters/dictionaries.

Contacting support is still recommended but like I stated before it is possible that those devices and the software are no longer supported.

Are they feature keys for anti-spam and other features still valid? Is it possible for you to try to upgrade the AsyncOS?

If possible, run:

> version

> asstatus ironport

> featurekey list

> status detail

> tail antispam

and kindly send us the output.

The last command, tail antispam can be cancelled with CTRL + C. Send the last few lines.

Regards,

Valter

IRONPORT)> version

Current Version
===============
Product: Cisco IronPort C670 Messaging Gateway(tm) Appliance
Model: C670
Version: 8.0.0-671
Build Date: 2013-06-01
Install Date: 2013-07-18 02:42:46
Serial #: A4BADB296935-6ZC8QM1
BIOS: 0.0.1C
RAID: 1.21.02-0528, 2.01.00, 1.02-014B
RAID Status: Optimal
RAID Type: 10
BMC: 1.00
(IRONPORT)>

(IRONPORT)>

(IRONPORT)> asstatus ironport

  Component              Last Update                  Version
  CASE Core Files        18 Jul 2013 07:42 (GMT +00:00)  3.2.0-025
  CASE Utilities         18 Jul 2013 07:42 (GMT +00:00)  3.2.0-025
  Structural Rules       29 Aug 2013 08:04 (GMT +00:00)  3.2.0-025-20130828_181500
  Web Reputation DB      29 Aug 2013 07:29 (GMT +00:00)  20130829_072519
  Web Reputation DB Update  29 Aug 2013 10:39 (GMT +00:00)  20130829_072519-20130829_103524
  Content Rules          29 Aug 2013 12:50 (GMT +00:00)  20130829_124702
  Content Rules Update   29 Aug 2013 12:50 (GMT +00:00)  20130829_124901


(IRONPORT)> featurekey list

Module                              Quantity   Status     Remaining   Expiration Date
Centralized Management              1          Active     702 days    Sat Aug  1 14:02:44 2015
IronPort Email Encryption           1          Dormant    30 days     Sat Sep 28 07:54:18 2013
IronPort Anti-Spam                  240800     Active     698 days    Tue Jul 28 22:02:45 2015
Sophos Anti-Virus                   240800     Active     698 days    Tue Jul 28 22:02:45 2015
Incoming Mail Handling              1          Active     Perpetual   N/A
Outbreak Filters                    240800     Active     698 days    Tue Jul 28 22:02:45 2015
Bounce Verification                 1          Dormant    Perpetual   N/A
(IRONPORT)> status detail

Status as of:                  Thu Aug 29 07:54:25 2013 CDT
Up since:                      Wed Aug 14 11:41:13 2013 CDT (14d 20h 13m 12s)
Last counter reset:            Never
System status:                 Online
Oldest Message:                2 weeks 1 day 3 mins 24 secs
Feature - Sophos Anti-Virus:   698 days
Feature - Bounce Verification: Perpetual
Feature - Centralized Management: 702 days
Feature - IronPort Anti-Spam:  698 days
Feature - IronPort Email Encryption: 30 days
Feature - Incoming Mail Handling: Perpetual
Feature - Outbreak Filters:    698 days

Counters:                               Reset          Uptime        Lifetime
  Receiving
    Messages Received              35,204,466       2,093,132      35,204,466
    Recipients Received            41,154,917       2,366,033      41,154,917
    Gen. Bounce Recipients             68,573           2,058          68,573
  Rejection
    Rejected Recipients             2,675,460         151,912       2,675,460
    Dropped Messages                  495,701          15,724         495,701
  Queue
    Soft Bounced Events               421,476          32,949         421,476
  Completion
    Completed Recipients           41,535,193       2,455,507      41,535,193
      Hard Bounced Recipients         118,883           4,103         118,883
        DNS Hard Bounces               12,347             389          12,347
        5XX Hard Bounces               85,358           3,079          85,358
        Expired Hard Bounces           20,753             635          20,753
        Filter Hard Bounces                 0               0               0
        Other Hard Bounces                425               0             425
      Delivered Recipients         40,536,736       2,389,705      40,536,736
      Deleted Recipients              879,574          61,699         879,574
        Global Unsub. Hits                  0               0               0
    DomainKeys Signed Msgs                  0               0               0
  Current IDs
    Message ID (MID)                                                 38697713
    Injection Conn. ID (ICID)                                       162105548
    Delivery Conn. ID (DCID)                                         12901575

Rates (Events Per Hour):             1-Minute       5-Minutes      15-Minutes
  Receiving
    Messages Received                  11,730          14,570          14,667
    Recipients Received                13,758          17,443          17,300
  Queue
    Soft Bounced Events                   939             578             503
  Completion
    Completed Recipients               15,596          17,658          17,642
      Hard Bounced Recipients              19              36              33
      Delivered Recipients             15,577          17,599          17,568

Gauges:                                      Current
  System
    RAM Utilization                              25%
    CPU Utilization
      Total                                     100%
      MGA                                        43%
      Anti-Spam                                  46%
      Anti-Virus                                  3%
      Reporting                                   6%
      Quarantine                                  0%
    Disk I/O Utilization                          8%
    Resource Conservation                          0
    Logging Disk Usage                            8%
    Logging Disk Available                      387G
  Connections
    Current Inbound Conn.                         25
    Current Outbound Conn.                        95
  Queue
    Active Recipients                            614
      Unattempted Recipients                     504
      Attempted Recipients                       110
    Messages In Work Queue                         6
    Destinations In Memory                     2,117
    Kilobytes Used                         2,830,293
    Kilobytes Free                        68,472,875
    Messages In Quarantine
      Policy, Virus and Outbreak              41,739
    Kilobytes In Quarantine
      Policy, Virus and Outbreak           2,234,549

(IRONPORT)>

(IRONPORT)>

Press Ctrl-C to stop.
Thu Aug 29 07:54:49 2013 Info: brightmail antispam - IRONPORT postgres[68361]: [66-1] 68361WARNING:  nonstandard use of escape in a string literal at character 109
Thu Aug 29 07:54:49 2013 Info: brightmail antispam - IRONPORT postgres[68361]: [66-2] 68361HINT:  Use the escape string syntax for escapes, e.g., E'\r\n'.
Thu Aug 29 07:54:49 2013 Info: brightmail antispam - IRONPORT postgres[68361]: [67-1] 68361WARNING:  nonstandard use of escape in a string literal at character 205
Thu Aug 29 07:54:49 2013 Info: brightmail antispam - IRONPORT postgres[68361]: [67-2] 68361HINT:  Use the escape string syntax for escapes, e.g., E'\r\n'.
Thu Aug 29 07:54:49 2013 Info: brightmail antispam - IRONPORT postgres[68361]: [68-1] 68361WARNING:  nonstandard use of \' in a string literal at character 282
Thu Aug 29 07:54:49 2013 Info: brightmail antispam - IRONPORT postgres[68361]: [68-2] 68361HINT:  Use '' to write quotes in strings, or use the escape string syntax (E'...').
Thu Aug 29 07:54:49 2013 Info: brightmail antispam - IRONPORT postgres[68361]: [69-1] 68361WARNING:  nonstandard use of escape in a string literal at character 109
Thu Aug 29 07:54:49 2013 Info: brightmail antispam - IRONPORT postgres[68361]: [69-2] 68361HINT:  Use the escape string syntax for escapes, e.g., E'\r\n'.
Thu Aug 29 07:54:49 2013 Info: brightmail antispam - IRONPORT postgres[68361]: [70-1] 68361WARNING:  nonstandard use of escape in a string literal at character 193
Thu Aug 29 07:54:49 2013 Info: brightmail antispam - IRONPORT postgres[68361]: [70-2] 68361HINT:  Use the escape string syntax for escapes, e.g., E'\r\n'.
Thu Aug 29 07:54:55 2013 Info: brightmail antispam - IRONPORT postgres[68361]: [71-1] 68361WARNING:  nonstandard use of escape in a string literal at character 222
Thu Aug 29 07:54:55 2013 Info: brightmail antispam - IRONPORT postgres[68361]: [71-2] 68361HINT:  Use the escape string syntax for escapes, e.g., E'\r\n'.
Thu Aug 29 07:54:55 2013 Info: brightmail antispam - IRONPORT postgres[68361]: [72-1] 68361WARNING:  nonstandard use of escape in a string literal at character 227
Thu Aug 29 07:54:55 2013 Info: brightmail antispam - IRONPORT postgres[68361]: [72-2] 68361HINT:  Use the escape string syntax for escapes, e.g., E'\r\n'.
Thu Aug 29 07:55:07 2013 Info: brightmail antispam - IRONPORT postgres[39952]: [68-1] 39952WARNING:  nonstandard use of \\ in a string literal at character 73
Thu Aug 29 07:55:07 2013 Info: brightmail antispam - IRONPORT postgres[39952]: [68-2] 39952HINT:  Use the escape string syntax for backslashes, e.g., E'\\'.
Thu Aug 29 07:55:14 2013 Info: brightmail antispam - IRONPORT postgres[68361]: [73-1] 68361WARNING:  nonstandard use of escape in a string literal at character 222
Thu Aug 29 07:55:14 2013 Info: brightmail antispam - IRONPORT postgres[68361]: [73-2] 68361HINT:  Use the escape string syntax for escapes, e.g., E'\r\n'.
Thu Aug 29 07:55:23 2013 Info: case antispam - engine (68966) : startup: Region profile: Using profile global
Thu Aug 29 07:55:23 2013 Info: case antispam - engine (68966) : logger: removing stderr method
Thu Aug 29 07:55:42 2013 Info: case antispam - engine (68966) : config: Finished loading configuration
Thu Aug 29 07:55:42 2013 Info: case antispam - engine (68966) : case-daemon: server started on UNIX domain socket [tmpdir]case_srv.sock (running version 3.2.0)
Thu Aug 29 07:55:42 2013 Info: case antispam - engine (68966) : case-daemon: server pid: 68966
Thu Aug 29 07:55:42 2013 Info: case antispam - engine (69039) : case-daemon: Initializing Child
Thu Aug 29 07:55:42 2013 Info: case antispam - engine (69040) : case-daemon: Initializing Child
Thu Aug 29 07:55:42 2013 Info: case antispam - engine (69041) : case-daemon: Initializing Child
Thu Aug 29 07:55:42 2013 Info: case antispam - engine (69042) : case-daemon: Initializing Child
Thu Aug 29 07:55:42 2013 Info: case antispam - engine (69043) : case-daemon: Initializing Child
Thu Aug 29 07:55:42 2013 Info: case antispam - engine (69044) : case-daemon: Initializing Child
Thu Aug 29 07:55:54 2013 Info: brightmail antispam - IRONPORT postgres[68361]: [74-1] 68361WARNING:  nonstandard use of escape in a string literal at character 180
Thu Aug 29 07:55:54 2013 Info: brightmail antispam - IRONPORT postgres[68361]: [74-2] 68361HINT:  Use the escape string syntax for escapes, e.g., E'\r\n'.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: