topic Re: CPU Affinity Problem in Firewall and Security Management

CPU Affinity Problem

zarkathus — Fri, 25 Feb 2022 12:47:18 GMT

Hello mates,

I've running with some problems with my security gateway.

It's a robust 16000 model with forty-eight cores.

Every week i need to check the affinity of CPUs for the vpnd and pdpd process, because on extreme days (more than seven hundred vpn connections) if the vpnd and pdpd is set to one core only, crashes the process and all my tunnels goes down.

PS: The auto (for some reason) defined core runs over 95% all the time unless I set more CPU cores to the process.

So, I set a suitable number of cores and runs fine for some days. Is there some automatic routine that changes this? Because every week the change comes back to only one core, and I need to monitor if everything is set properly.

Any advice?

Regards,

Re: CPU Affinity Problem

zarkathus — Fri, 25 Feb 2022 12:58:06 GMT

Re: CPU Affinity Problem

Timothy_Hall — Fri, 25 Feb 2022 13:24:20 GMT

vpnd is a child process of fwd, and this appears to be a known issue: sk173931: Wrong affinity for FWD child processes

Re: CPU Affinity Problem

zarkathus — Fri, 25 Feb 2022 13:28:14 GMT

Hello @Timothy_Hall ,

Thanks for your reply.

I didn't mention it before, but we are running r80.30 yet.

Planning to upgrade the the next two months.

The SK is valid only for 80.40?

Regards,

Re: CPU Affinity Problem

Timothy_Hall — Fri, 25 Feb 2022 13:36:49 GMT

Not sure, but it probably applies to R80.30 as well; you'll need to open a TAC case to find out. @PhoneBoy can you ask/alert the owner of the SK?

Re: CPU Affinity Problem

PhoneBoy — Fri, 25 Feb 2022 21:03:49 GMT

The SK looks like it applies to R80.40 precisely because that's where the bug was found.
There's nothing that suggests this bug doesn't exist in other releases as well.
Regardless, a TAC case is needed to get to the bottom of it.