New SSM-IPS40 show 50% CPU with no traffic

[dschwind]

We're getting ready to deploy 2 ASA 5585s with SSM-IPS40 modules.  IDM reports 8 cpus at 100% utilization for a total of 50% cpu utilization.  Is IDM reporting this in error?  I'm not finding a way to check on the CLI.  There is no traffic traversing these devices at the moment.

Thanks in advance for any help.

Dennis

[dschwind]

I should include the SSP_IPS40 blades shipped with 7.1(1)E4.

[svaish · Accepted solution]

As from E3 engine updates, the IPS uses a different algorithm for managing its idle

time,and spends more time polling for packets to reduce latency. The E3 changes included a

fix to a problem with high latency during low traffic loads. The fix was to have sensorApp

check the packet buffers on the driver more often. So the packet could be pulled off the

driver queue quicker for analysis instead of waiting for the driver to fill the queue

before passing it to sensorApp. This increased checking caused a corresponding increase in

cpu usage.

The CPU Utilization measurement can/will be high, due to the change made in

the E3 engine, polling the sensing interfaces for more data. This is OK as if/when the

sensorApp process requires additional CPU time, the amount the polling is using is

dynamically scaled back to useful for determining actual sensor load.

So do not worry for the HIGH CPU but check the Processing load percentage on the IPS.

Please post if there are still unanswered questions.

,

Sachin

[dschwind]

How would I check processing load?

Dennis

[svaish · Accepted solution]

show statistics virtual-sensor VS0

Virtual Sensor Statistics

Statistics for Virtual Sensor vs0

Processing Load Percentage = XX

or on the IDM where you see the Graph for the CPU in the same circlr you would see Inspection Load.

Sachin

[dschwind]

Ah, very good. 

Thanks a bunch.

Dennis

[svaish · Accepted solution]

Please mark as answered if answered