Cisco Support Community
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
Community Member

100% Sensor load during some period

Dear ALL,

Issue: IDSM is showing 100% Inspection(Sensor) Load during certain periods daily which causes more than 2000 ms delay in the network.This issue occurs after upgrading the signature engine to E3

We have also monitored the traffic during 100% Load on PRTG but traffic has still in normal utilization 40 to 50Mb.

I have found the same 100% Load issue on the Cisco TAC case.

Has any one faced this issue before in their workaround. Actually we are not sure about our issue. Is our issue also related to SMTP traffic or not as in the TAC case.

How can we identify our issue?

Please see the following TAC case:


IDSM is showing high CPU and a "processing load percentage" of 100 during certain periods daily. Traffic is affected at those times.


Issue has been identified to be linked to smtp traffic.

How can we solve/identify this issue?

Please provide us the appropriate solution for this issue.

Here are the details of IDSM-2:

Our IDSM is in Inline VLAN-Pair Mode:

Inline TCP Tracking Mode: Interface and VLAN

Core Switch IPS Etherchannel Setup:


Group 5: IDSM(A) and IDSM(B) Port x/7

Group 6: IDSM(A) and IDSM(B) Port x/8

Some VLAN Pair(s) are on interface x/7 and others are on x/8

There is an FWSM module also, which acts as the default gateway for all internal VLANs.

All signatures are in default state.

IPS1 version Detail:

Cisco Intrusion Prevention System, Version 6.1(2)E3

Signature Update S440.0

OS Version:2.4.30-IDS-smp-bigphys


Cisco6513 IOS: Version 12.2(18)SXF17

Thanks in advance.




Re: 100% Sensor load during some period

You don't say how much traffic you are trying to push through that IDSM, but if you overload it, you will get delay and lost packets.

You can try putting the sensor into promisicous mode and doing shunning on the FWSM. That way, no matter how badly the sensor performs, you will not distrupt traffic.

Community Member

Re: 100% Sensor load during some period

This is not a traffic issue. Traffic shows very low during 100% sensor load.



Community Member

Re: 100% Sensor load during some period

I get "Red" status events on "inspectionLoad" very frequently. I am not quite sure if it has always been this frequent. I wonder if the "healthAndSecurity" status alerts can be sent off to a syslog server for long term storage, review and analysis.

Are you getting "Red" status events on "inspectionLoad"? Just recently or all the time.

There is another thread in this forum about something like highcpu or something like that. I am not sure if that one was very specific.

I wonder if this is related to Cisco updating signature files with new sigs are enabled by default related to 5 year old vulnerabilities.

evStatus: eventId=REMOVED




appName: monitor

appInstanceId: 345

time: Nov 03, 2009 19:08:51 UTC offset=-300 timeZone=EST


description: Health and security status

healthStatus: red


virtualSensor: vs0

status: green


metricValue: name=inspectionLoad


value: 94

status: red


value: 17

status: green


type: upper

yellow: 80

red: 91


metricStatus: name=inspectionLoad

status: red

Community Member

Re: 100% Sensor load during some period

May be there are lot of small packets going through the sensor.

Activate flood-signatures and analyze alerts.

CreatePlease to create content