PIX CPU process above 100%

[andy.cruz]

Our customer is asking about the occurence of CPU spikes. From the PIX documentation:

"%PIX-3-211003: CPU utilization for time seconds = %cpu_usage

Explanation: This message is displayed if the percentage of CPU usage is greater than 100% for time seconds.

Action: If this message occurs frequently, contact Cisco TAC."

If the message doesn't occur frequently, what??

The customer is worried that, maybe, during the time the CPU goes above 100% packets will be dropped. Is there any another workaround? Is there a way to capture "show process" a few seconds after (if not during) the CPU goes up?

Sorry for the poor description and questions.

Thanks in advance for any help.

Andy

[nkhawaja]

Hi,

If the message doesn't occur frequently then, what to worry about? Spikes can happen on a network. But the only time you need to worry is if CPU stays high most of the time.

Yes there is a possibility that packets be dropped. The workaround is to use a high end PIX platform or block the attack at the source using access-lists etc.

Thanks

Nadeem

[lwierenga]

Also, it doesn't necessary mean that this is an attack in progress. How many ACL's are you using? Are you logging all your ACL's? You can run PDM and get a better picture over a period of time, but then again Nadeem's correct if it doesn't last more then 7 seconds, and not happing very often...

[dhucaby]

Firing up PDM may also add to the CPU load, although it sure does make some nice graphs. An alternative might be to use SNMP on the PIX. As long as your SNMP management station has the CISCO-PROCESS-MIB, you can query the ciscoProcess subtree (1.3.6.1.4.1.9.9.109) for the 5-second, 1-minute, and 5-minute CPU usage stats.

Perhaps you could set an alarm threshold on the CPU value that would run a script to connect to the PIX and dump the "show processes" output.

Sounds like a lot of work for something that may not necessarily be bad :-)

DaveH