Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

PIX CPU process above 100%

Our customer is asking about the occurence of CPU spikes. From the PIX documentation:

"%PIX-3-211003: CPU utilization for time seconds = %cpu_usage

Explanation: This message is displayed if the percentage of CPU usage is greater than 100% for time seconds.

Action: If this message occurs frequently, contact Cisco TAC."

If the message doesn't occur frequently, what??

The customer is worried that, maybe, during the time the CPU goes above 100% packets will be dropped. Is there any another workaround? Is there a way to capture "show process" a few seconds after (if not during) the CPU goes up?

Sorry for the poor description and questions.

Thanks in advance for any help.

Andy

3 REPLIES
Cisco Employee

Re: PIX CPU process above 100%

Hi,

If the message doesn't occur frequently then, what to worry about? Spikes can happen on a network. But the only time you need to worry is if CPU stays high most of the time.

Yes there is a possibility that packets be dropped. The workaround is to use a high end PIX platform or block the attack at the source using access-lists etc.

Thanks

Nadeem

New Member

Re: PIX CPU process above 100%

Also, it doesn't necessary mean that this is an attack in progress. How many ACL's are you using? Are you logging all your ACL's? You can run PDM and get a better picture over a period of time, but then again Nadeem's correct if it doesn't last more then 7 seconds, and not happing very often...

New Member

Re: PIX CPU process above 100%

Firing up PDM may also add to the CPU load, although it sure does make some nice graphs. An alternative might be to use SNMP on the PIX. As long as your SNMP management station has the CISCO-PROCESS-MIB, you can query the ciscoProcess subtree (1.3.6.1.4.1.9.9.109) for the 5-second, 1-minute, and 5-minute CPU usage stats.

Perhaps you could set an alarm threshold on the CPU value that would run a script to connect to the PIX and dump the "show processes" output.

Sounds like a lot of work for something that may not necessarily be bad :-)

DaveH

195
Views
0
Helpful
3
Replies