02-16-2009 08:07 AM
Hi there
we have a cluster of x 2 C600 machines (version 6.5.0-405)
since 5-6 days we have a 99% to 100% CPU Load , but Ram utilization is
just 7%
Messages in Workqueue are also not to high
The count on incoming messages and even REJECTED's are also
just the same of even less as all the days before.
Has anyone an Idea what can be the reason of the High CPU Load ??
THX in advance
02-16-2009 09:32 AM
Hello,
Have you tried restarting the appliances? It could be some process went awry.
Also, so check if the automatic antispam update is not disabled.
Hope this helps.
Regards,
02-16-2009 10:42 AM
yes, automatic Antispam Update is activated
Here is the last Update :
Structural Rules (2.7.0-102-20090215_144905)
Content Rules (20090216_102009)
Content Rules Update (20090216_102303 )
take a look at the CPU-Utilization Below:
CPU Utilization
Email Security Appliance: 7.0%
Anti-Spam: 87.0%
Anti-Virus: 3.0%
Reporting: 0.0%
Quarantine: 0.0%
Total CPU Utilization: 100.0%
It seems to me that Antispam Engine is pretty busy
but WHY 24 Hours ?
I think i must take a look at the Filters (MSG & Content)
-----
02-16-2009 05:47 PM
I would suggest verifying the config unless something has changed in the past few days. Do you have the policies set to scan SPAM for both inbound and outbound?
Also verify the max_scan_size (for IPAS, if used) is set higher than 130k is set higher than 130K (suggested value).
02-17-2009 08:56 AM
Anti Spam scanning is only configured for Incoming Policies,
max scan size for IPAS is also set to 130K
--
We still have this high load of 100% on each machine
and Anti Spam is stil busy with more than 80%
@kyerramr:
you'r right its all about Anti Spam Engine
02-17-2009 07:27 PM
Hi,
I recommend that you open a support ticket and have them look at the queues, Possibility of a message stuck in the queue causing processing issues.
08-29-2013 05:35 AM
Folks,
C600 machines and AsyncOS version 6.5.0-405 are no longer supported. I see this thread did start in 2009 and there was a recommendation, at that time, to open a ticket with support.
Hi CPU utilization could be related to IPAS engine/updates/corruption but also to a variety of other issues, for instance, high mail flow, large messages and expensive regex used with filters/dictionaries.
Contacting support is still recommended but like I stated before it is possible that those devices and the software are no longer supported.
Are they feature keys for anti-spam and other features still valid? Is it possible for you to try to upgrade the AsyncOS?
If possible, run:
> version
> asstatus ironport
> featurekey list
> status detail
> tail antispam
and kindly send us the output.
The last command, tail antispam can be cancelled with CTRL + C. Send the last few lines.
Regards,
Valter
08-29-2013 06:03 AM
IRONPORT)> version
Current Version
===============
Product: Cisco IronPort C670 Messaging Gateway(tm) Appliance
Model: C670
Version: 8.0.0-671
Build Date: 2013-06-01
Install Date: 2013-07-18 02:42:46
Serial #: A4BADB296935-6ZC8QM1
BIOS: 0.0.1C
RAID: 1.21.02-0528, 2.01.00, 1.02-014B
RAID Status: Optimal
RAID Type: 10
BMC: 1.00
(IRONPORT)>
(IRONPORT)>
(IRONPORT)> asstatus ironport
Component Last Update Version
CASE Core Files 18 Jul 2013 07:42 (GMT +00:00) 3.2.0-025
CASE Utilities 18 Jul 2013 07:42 (GMT +00:00) 3.2.0-025
Structural Rules 29 Aug 2013 08:04 (GMT +00:00) 3.2.0-025-20130828_181500
Web Reputation DB 29 Aug 2013 07:29 (GMT +00:00) 20130829_072519
Web Reputation DB Update 29 Aug 2013 10:39 (GMT +00:00) 20130829_072519-20130829_103524
Content Rules 29 Aug 2013 12:50 (GMT +00:00) 20130829_124702
Content Rules Update 29 Aug 2013 12:50 (GMT +00:00) 20130829_124901
(IRONPORT)> featurekey list
Module Quantity Status Remaining Expiration Date
Centralized Management 1 Active 702 days Sat Aug 1 14:02:44 2015
IronPort Email Encryption 1 Dormant 30 days Sat Sep 28 07:54:18 2013
IronPort Anti-Spam 240800 Active 698 days Tue Jul 28 22:02:45 2015
Sophos Anti-Virus 240800 Active 698 days Tue Jul 28 22:02:45 2015
Incoming Mail Handling 1 Active Perpetual N/A
Outbreak Filters 240800 Active 698 days Tue Jul 28 22:02:45 2015
Bounce Verification 1 Dormant Perpetual N/A
(IRONPORT)> status detail
Status as of: Thu Aug 29 07:54:25 2013 CDT
Up since: Wed Aug 14 11:41:13 2013 CDT (14d 20h 13m 12s)
Last counter reset: Never
System status: Online
Oldest Message: 2 weeks 1 day 3 mins 24 secs
Feature - Sophos Anti-Virus: 698 days
Feature - Bounce Verification: Perpetual
Feature - Centralized Management: 702 days
Feature - IronPort Anti-Spam: 698 days
Feature - IronPort Email Encryption: 30 days
Feature - Incoming Mail Handling: Perpetual
Feature - Outbreak Filters: 698 days
Counters: Reset Uptime Lifetime
Receiving
Messages Received 35,204,466 2,093,132 35,204,466
Recipients Received 41,154,917 2,366,033 41,154,917
Gen. Bounce Recipients 68,573 2,058 68,573
Rejection
Rejected Recipients 2,675,460 151,912 2,675,460
Dropped Messages 495,701 15,724 495,701
Queue
Soft Bounced Events 421,476 32,949 421,476
Completion
Completed Recipients 41,535,193 2,455,507 41,535,193
Hard Bounced Recipients 118,883 4,103 118,883
DNS Hard Bounces 12,347 389 12,347
5XX Hard Bounces 85,358 3,079 85,358
Expired Hard Bounces 20,753 635 20,753
Filter Hard Bounces 0 0 0
Other Hard Bounces 425 0 425
Delivered Recipients 40,536,736 2,389,705 40,536,736
Deleted Recipients 879,574 61,699 879,574
Global Unsub. Hits 0 0 0
DomainKeys Signed Msgs 0 0 0
Current IDs
Message ID (MID) 38697713
Injection Conn. ID (ICID) 162105548
Delivery Conn. ID (DCID) 12901575
Rates (Events Per Hour): 1-Minute 5-Minutes 15-Minutes
Receiving
Messages Received 11,730 14,570 14,667
Recipients Received 13,758 17,443 17,300
Queue
Soft Bounced Events 939 578 503
Completion
Completed Recipients 15,596 17,658 17,642
Hard Bounced Recipients 19 36 33
Delivered Recipients 15,577 17,599 17,568
Gauges: Current
System
RAM Utilization 25%
CPU Utilization
Total 100%
MGA 43%
Anti-Spam 46%
Anti-Virus 3%
Reporting 6%
Quarantine 0%
Disk I/O Utilization 8%
Resource Conservation 0
Logging Disk Usage 8%
Logging Disk Available 387G
Connections
Current Inbound Conn. 25
Current Outbound Conn. 95
Queue
Active Recipients 614
Unattempted Recipients 504
Attempted Recipients 110
Messages In Work Queue 6
Destinations In Memory 2,117
Kilobytes Used 2,830,293
Kilobytes Free 68,472,875
Messages In Quarantine
Policy, Virus and Outbreak 41,739
Kilobytes In Quarantine
Policy, Virus and Outbreak 2,234,549
(IRONPORT)>
(IRONPORT)>
Press Ctrl-C to stop.
Thu Aug 29 07:54:49 2013 Info: brightmail antispam - IRONPORT postgres[68361]: [66-1] 68361WARNING: nonstandard use of escape in a string literal at character 109
Thu Aug 29 07:54:49 2013 Info: brightmail antispam - IRONPORT postgres[68361]: [66-2] 68361HINT: Use the escape string syntax for escapes, e.g., E'\r\n'.
Thu Aug 29 07:54:49 2013 Info: brightmail antispam - IRONPORT postgres[68361]: [67-1] 68361WARNING: nonstandard use of escape in a string literal at character 205
Thu Aug 29 07:54:49 2013 Info: brightmail antispam - IRONPORT postgres[68361]: [67-2] 68361HINT: Use the escape string syntax for escapes, e.g., E'\r\n'.
Thu Aug 29 07:54:49 2013 Info: brightmail antispam - IRONPORT postgres[68361]: [68-1] 68361WARNING: nonstandard use of \' in a string literal at character 282
Thu Aug 29 07:54:49 2013 Info: brightmail antispam - IRONPORT postgres[68361]: [68-2] 68361HINT: Use '' to write quotes in strings, or use the escape string syntax (E'...').
Thu Aug 29 07:54:49 2013 Info: brightmail antispam - IRONPORT postgres[68361]: [69-1] 68361WARNING: nonstandard use of escape in a string literal at character 109
Thu Aug 29 07:54:49 2013 Info: brightmail antispam - IRONPORT postgres[68361]: [69-2] 68361HINT: Use the escape string syntax for escapes, e.g., E'\r\n'.
Thu Aug 29 07:54:49 2013 Info: brightmail antispam - IRONPORT postgres[68361]: [70-1] 68361WARNING: nonstandard use of escape in a string literal at character 193
Thu Aug 29 07:54:49 2013 Info: brightmail antispam - IRONPORT postgres[68361]: [70-2] 68361HINT: Use the escape string syntax for escapes, e.g., E'\r\n'.
Thu Aug 29 07:54:55 2013 Info: brightmail antispam - IRONPORT postgres[68361]: [71-1] 68361WARNING: nonstandard use of escape in a string literal at character 222
Thu Aug 29 07:54:55 2013 Info: brightmail antispam - IRONPORT postgres[68361]: [71-2] 68361HINT: Use the escape string syntax for escapes, e.g., E'\r\n'.
Thu Aug 29 07:54:55 2013 Info: brightmail antispam - IRONPORT postgres[68361]: [72-1] 68361WARNING: nonstandard use of escape in a string literal at character 227
Thu Aug 29 07:54:55 2013 Info: brightmail antispam - IRONPORT postgres[68361]: [72-2] 68361HINT: Use the escape string syntax for escapes, e.g., E'\r\n'.
Thu Aug 29 07:55:07 2013 Info: brightmail antispam - IRONPORT postgres[39952]: [68-1] 39952WARNING: nonstandard use of \\ in a string literal at character 73
Thu Aug 29 07:55:07 2013 Info: brightmail antispam - IRONPORT postgres[39952]: [68-2] 39952HINT: Use the escape string syntax for backslashes, e.g., E'\\'.
Thu Aug 29 07:55:14 2013 Info: brightmail antispam - IRONPORT postgres[68361]: [73-1] 68361WARNING: nonstandard use of escape in a string literal at character 222
Thu Aug 29 07:55:14 2013 Info: brightmail antispam - IRONPORT postgres[68361]: [73-2] 68361HINT: Use the escape string syntax for escapes, e.g., E'\r\n'.
Thu Aug 29 07:55:23 2013 Info: case antispam - engine (68966) : startup: Region profile: Using profile global
Thu Aug 29 07:55:23 2013 Info: case antispam - engine (68966) : logger: removing stderr method
Thu Aug 29 07:55:42 2013 Info: case antispam - engine (68966) : config: Finished loading configuration
Thu Aug 29 07:55:42 2013 Info: case antispam - engine (68966) : case-daemon: server started on UNIX domain socket [tmpdir]case_srv.sock (running version 3.2.0)
Thu Aug 29 07:55:42 2013 Info: case antispam - engine (68966) : case-daemon: server pid: 68966
Thu Aug 29 07:55:42 2013 Info: case antispam - engine (69039) : case-daemon: Initializing Child
Thu Aug 29 07:55:42 2013 Info: case antispam - engine (69040) : case-daemon: Initializing Child
Thu Aug 29 07:55:42 2013 Info: case antispam - engine (69041) : case-daemon: Initializing Child
Thu Aug 29 07:55:42 2013 Info: case antispam - engine (69042) : case-daemon: Initializing Child
Thu Aug 29 07:55:42 2013 Info: case antispam - engine (69043) : case-daemon: Initializing Child
Thu Aug 29 07:55:42 2013 Info: case antispam - engine (69044) : case-daemon: Initializing Child
Thu Aug 29 07:55:54 2013 Info: brightmail antispam - IRONPORT postgres[68361]: [74-1] 68361WARNING: nonstandard use of escape in a string literal at character 180
Thu Aug 29 07:55:54 2013 Info: brightmail antispam - IRONPORT postgres[68361]: [74-2] 68361HINT: Use the escape string syntax for escapes, e.g., E'\r\n'.
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: