cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
2304
Views
0
Helpful
1
Replies

Re: C670 CPU Load TOO HIGH (100%)

did we get a solution ?

IRONPORT)> version

Current Version
===============
Product: Cisco IronPort C670 Messaging Gateway(tm) Appliance
Model: C670
Version: 8.0.0-671
Build Date: 2013-06-01
Install Date: 2013-07-18 02:42:46
Serial #: A4BADB296935-6ZC8QM1
BIOS: 0.0.1C
RAID: 1.21.02-0528, 2.01.00, 1.02-014B
RAID Status: Optimal
RAID Type: 10
BMC: 1.00
(IRONPORT)>

(IRONPORT)>

(IRONPORT)> asstatus ironport

  Component              Last Update                  Version
  CASE Core Files        18 Jul 2013 07:42 (GMT +00:00)  3.2.0-025
  CASE Utilities         18 Jul 2013 07:42 (GMT +00:00)  3.2.0-025
  Structural Rules       29 Aug 2013 08:04 (GMT +00:00)  3.2.0-025-20130828_181500
  Web Reputation DB      29 Aug 2013 07:29 (GMT +00:00)  20130829_072519
  Web Reputation DB Update  29 Aug 2013 10:39 (GMT +00:00)  20130829_072519-20130829_103524
  Content Rules          29 Aug 2013 12:50 (GMT +00:00)  20130829_124702
  Content Rules Update   29 Aug 2013 12:50 (GMT +00:00)  20130829_124901


(IRONPORT)> featurekey list

Module                              Quantity   Status     Remaining   Expiration Date
Centralized Management              1          Active     702 days    Sat Aug  1 14:02:44 2015
IronPort Email Encryption           1          Dormant    30 days     Sat Sep 28 07:54:18 2013
IronPort Anti-Spam                  240800     Active     698 days    Tue Jul 28 22:02:45 2015
Sophos Anti-Virus                   240800     Active     698 days    Tue Jul 28 22:02:45 2015
Incoming Mail Handling              1          Active     Perpetual   N/A
Outbreak Filters                    240800     Active     698 days    Tue Jul 28 22:02:45 2015
Bounce Verification                 1          Dormant    Perpetual   N/A
(IRONPORT)> status detail

Status as of:                  Thu Aug 29 07:54:25 2013 CDT
Up since:                      Wed Aug 14 11:41:13 2013 CDT (14d 20h 13m 12s)
Last counter reset:            Never
System status:                 Online
Oldest Message:                2 weeks 1 day 3 mins 24 secs
Feature - Sophos Anti-Virus:   698 days
Feature - Bounce Verification: Perpetual
Feature - Centralized Management: 702 days
Feature - IronPort Anti-Spam:  698 days
Feature - IronPort Email Encryption: 30 days
Feature - Incoming Mail Handling: Perpetual
Feature - Outbreak Filters:    698 days

Counters:                               Reset          Uptime        Lifetime
  Receiving
    Messages Received              35,204,466       2,093,132      35,204,466
    Recipients Received            41,154,917       2,366,033      41,154,917
    Gen. Bounce Recipients             68,573           2,058          68,573
  Rejection
    Rejected Recipients             2,675,460         151,912       2,675,460
    Dropped Messages                  495,701          15,724         495,701
  Queue
    Soft Bounced Events               421,476          32,949         421,476
  Completion
    Completed Recipients           41,535,193       2,455,507      41,535,193
      Hard Bounced Recipients         118,883           4,103         118,883
        DNS Hard Bounces               12,347             389          12,347
        5XX Hard Bounces               85,358           3,079          85,358
        Expired Hard Bounces           20,753             635          20,753
        Filter Hard Bounces                 0               0               0
        Other Hard Bounces                425               0             425
      Delivered Recipients         40,536,736       2,389,705      40,536,736
      Deleted Recipients              879,574          61,699         879,574
        Global Unsub. Hits                  0               0               0
    DomainKeys Signed Msgs                  0               0               0
  Current IDs
    Message ID (MID)                                                 38697713
    Injection Conn. ID (ICID)                                       162105548
    Delivery Conn. ID (DCID)                                         12901575

Rates (Events Per Hour):             1-Minute       5-Minutes      15-Minutes
  Receiving
    Messages Received                  11,730          14,570          14,667
    Recipients Received                13,758          17,443          17,300
  Queue
    Soft Bounced Events                   939             578             503
  Completion
    Completed Recipients               15,596          17,658          17,642
      Hard Bounced Recipients              19              36              33
      Delivered Recipients             15,577          17,599          17,568

Gauges:                                      Current
  System
    RAM Utilization                              25%
    CPU Utilization
      Total                                     100%
      MGA                                        43%
      Anti-Spam                                  46%
      Anti-Virus                                  3%
      Reporting                                   6%
      Quarantine                                  0%
    Disk I/O Utilization                          8%
    Resource Conservation                          0
    Logging Disk Usage                            8%
    Logging Disk Available                      387G
  Connections
    Current Inbound Conn.                         25
    Current Outbound Conn.                        95
  Queue
    Active Recipients                            614
      Unattempted Recipients                     504
      Attempted Recipients                       110
    Messages In Work Queue                         6
    Destinations In Memory                     2,117
    Kilobytes Used                         2,830,293
    Kilobytes Free                        68,472,875
    Messages In Quarantine
      Policy, Virus and Outbreak              41,739
    Kilobytes In Quarantine
      Policy, Virus and Outbreak           2,234,549

(IRONPORT)>

(IRONPORT)>

Press Ctrl-C to stop.
Thu Aug 29 07:54:49 2013 Info: brightmail antispam - IRONPORT postgres[68361]: [66-1] 68361WARNING:  nonstandard use of escape in a string literal at character 109
Thu Aug 29 07:54:49 2013 Info: brightmail antispam - IRONPORT postgres[68361]: [66-2] 68361HINT:  Use the escape string syntax for escapes, e.g., E'\r\n'.
Thu Aug 29 07:54:49 2013 Info: brightmail antispam - IRONPORT postgres[68361]: [67-1] 68361WARNING:  nonstandard use of escape in a string literal at character 205
Thu Aug 29 07:54:49 2013 Info: brightmail antispam - IRONPORT postgres[68361]: [67-2] 68361HINT:  Use the escape string syntax for escapes, e.g., E'\r\n'.
Thu Aug 29 07:54:49 2013 Info: brightmail antispam - IRONPORT postgres[68361]: [68-1] 68361WARNING:  nonstandard use of \' in a string literal at character 282
Thu Aug 29 07:54:49 2013 Info: brightmail antispam - IRONPORT postgres[68361]: [68-2] 68361HINT:  Use '' to write quotes in strings, or use the escape string syntax (E'...').
Thu Aug 29 07:54:49 2013 Info: brightmail antispam - IRONPORT postgres[68361]: [69-1] 68361WARNING:  nonstandard use of escape in a string literal at character 109
Thu Aug 29 07:54:49 2013 Info: brightmail antispam - IRONPORT postgres[68361]: [69-2] 68361HINT:  Use the escape string syntax for escapes, e.g., E'\r\n'.
Thu Aug 29 07:54:49 2013 Info: brightmail antispam - IRONPORT postgres[68361]: [70-1] 68361WARNING:  nonstandard use of escape in a string literal at character 193
Thu Aug 29 07:54:49 2013 Info: brightmail antispam - IRONPORT postgres[68361]: [70-2] 68361HINT:  Use the escape string syntax for escapes, e.g., E'\r\n'.
Thu Aug 29 07:54:55 2013 Info: brightmail antispam - IRONPORT postgres[68361]: [71-1] 68361WARNING:  nonstandard use of escape in a string literal at character 222
Thu Aug 29 07:54:55 2013 Info: brightmail antispam - IRONPORT postgres[68361]: [71-2] 68361HINT:  Use the escape string syntax for escapes, e.g., E'\r\n'.
Thu Aug 29 07:54:55 2013 Info: brightmail antispam - IRONPORT postgres[68361]: [72-1] 68361WARNING:  nonstandard use of escape in a string literal at character 227
Thu Aug 29 07:54:55 2013 Info: brightmail antispam - IRONPORT postgres[68361]: [72-2] 68361HINT:  Use the escape string syntax for escapes, e.g., E'\r\n'.
Thu Aug 29 07:55:07 2013 Info: brightmail antispam - IRONPORT postgres[39952]: [68-1] 39952WARNING:  nonstandard use of \\ in a string literal at character 73
Thu Aug 29 07:55:07 2013 Info: brightmail antispam - IRONPORT postgres[39952]: [68-2] 39952HINT:  Use the escape string syntax for backslashes, e.g., E'\\'.
Thu Aug 29 07:55:14 2013 Info: brightmail antispam - IRONPORT postgres[68361]: [73-1] 68361WARNING:  nonstandard use of escape in a string literal at character 222
Thu Aug 29 07:55:14 2013 Info: brightmail antispam - IRONPORT postgres[68361]: [73-2] 68361HINT:  Use the escape string syntax for escapes, e.g., E'\r\n'.
Thu Aug 29 07:55:23 2013 Info: case antispam - engine (68966) : startup: Region profile: Using profile global
Thu Aug 29 07:55:23 2013 Info: case antispam - engine (68966) : logger: removing stderr method
Thu Aug 29 07:55:42 2013 Info: case antispam - engine (68966) : config: Finished loading configuration
Thu Aug 29 07:55:42 2013 Info: case antispam - engine (68966) : case-daemon: server started on UNIX domain socket [tmpdir]case_srv.sock (running version 3.2.0)
Thu Aug 29 07:55:42 2013 Info: case antispam - engine (68966) : case-daemon: server pid: 68966
Thu Aug 29 07:55:42 2013 Info: case antispam - engine (69039) : case-daemon: Initializing Child
Thu Aug 29 07:55:42 2013 Info: case antispam - engine (69040) : case-daemon: Initializing Child
Thu Aug 29 07:55:42 2013 Info: case antispam - engine (69041) : case-daemon: Initializing Child
Thu Aug 29 07:55:42 2013 Info: case antispam - engine (69042) : case-daemon: Initializing Child
Thu Aug 29 07:55:42 2013 Info: case antispam - engine (69043) : case-daemon: Initializing Child
Thu Aug 29 07:55:42 2013 Info: case antispam - engine (69044) : case-daemon: Initializing Child
Thu Aug 29 07:55:54 2013 Info: brightmail antispam - IRONPORT postgres[68361]: [74-1] 68361WARNING:  nonstandard use of escape in a string literal at character 180
Thu Aug 29 07:55:54 2013 Info: brightmail antispam - IRONPORT postgres[68361]: [74-2] 68361HINT:  Use the escape string syntax for escapes, e.g., E'\r\n'.

1 Reply 1

Robert Sherwin
Cisco Employee
Cisco Employee

Nirvan -

I would recommend opening a direct support case w/ the TAC, and allow us to get direct access to your appliance to reivew and provide corrective action.

With your appliance running 8.0.0-671, actions that you can take before opening a case to see if this helps to alleviate some CPU churn, open a CLI/putty session:

'antivirusupdate force'

'antispamupdate ironport force'

Allow the updater to complete updates.  You can tail the 'updater_logs' to see when they complete.

You can monitor the version and rules packages with:

'antivirusstatus'

'antispamstatus ironport'

Assure that they update with the current date and time stamps.

If, after that time, you still are seeing a CPU churn - open a support case, and send us the configuration XML:

Please provide the config/XML of the appliance this was processed through.  The easiest way is with 'supportrequest' on the CLI:

> supportrequest

Do you want to send the support request to customersupport@ironport.com? [Y]>

Or --->

on the WEB GUI:

• Upper right corner, select 'Help and Support' -> Open a Support Case

• Un-select the checkbox for Cisco IronPort Customer Support

• Issue Subject - enter ''

• Repeat for description.

• Click Send

Regards,

Robert

Email Content Security Technical Services - RTP, NC

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: