4240 High CPU

[gaboughanem]

Hi,

I have a problem with an IPS 4240 cpu utilization. The cpu is reaching 100% and the traffic is being dropped. The IPS has been updated to the latest release 7.0.6 with latest signature update but the problem persisted.

I found out that there is a signature firing more often from certain internal ip addresses and the signature has not been seen before. i disabled the signature and IPS CPU's was back to normal. But after few days, the CPU problem came back and i am not  able to find a solution for it. Where the only solution is to put the IPS is in bypass mode on(never inspect traffic) where the cpu goes down to 7%.

i tryied to searched the forum and the only suggestion is to upgrade from E3 to E4 or upgrade to the latest version (which i already have done).

Anybody has any suggestion on how to troubleshoot or solve this problem.

Thank you in advanced.

George

[Diego Armando Cambronero Arias]

Hi,

Is the CPU at 100% or around 90% ? Actually high CPU is not a problem in the IPS. The problem you should worry about is HIGH inspection load what will drop packets but high CPU will not drop packets. I have worked with many IPS and they always have high cpu but that is not a problem you should worry about.

[gaboughanem]

Hello,

Thank you for your response.

The case is the i have high CPU(100%) but low inspection load (around 30%).

Any suggestions.

Regards,

[andrey.dugin]

May you tell what signature indicate such CPU usage?