Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
Community Member

IPS Cpu usage is high


I have an AIP-SSM-10 running inside an ASA-5520. the sensor CPU usage is 57-90%. What cause the problem might have occured?. please help me.

Cisco Employee

Re: IPS Cpu usage is high

High CPU is not an issue in-and-of itself.  There was a change made with the releae of the E3 analysis engine which makes more use of the CPU during idle periods.  This issue is outlined in the release notes from the time of the E3 release:

The change was made in response to bug CSCsu77935.  Here is the explanation from the release notes:

"The idle time algorithm of the sensor has been modified. Additional CPU  has been applied to polling the NICs to decrease the polling interval  and reduce latency. The CPU usage is thus reported as higher than in  previous releases, including external tools such as top and ps. You will  notice the additional CPU load on single-CPU platforms and on the  primary CPU of multicore systems.

Because the additional CPU load reported while polling is actually  available to process packets, and is reduced as inspection load goes up,  it does not negatively affect the overall throughput of the IPS.

The best indication of sensor load is shown under the Processing Load Percentage section in the show statistics virtual-sensor command output and on the IME Home Page."


CreatePlease to create content