topic Re: CPU Core Usage Imbalance in Firewall and Security Management

Re: CPU Core Usage Imbalance

Greatsamps — Sat, 19 Feb 2022 06:39:24 GMT

So i have finally been able to adjust the core settings to use all 4 as FW instances and get them rebooted. I am pleased to report that we are now seeing an even balance of load between all 4 cores.

Processors load
---------------------------------------------------------------------------------
|CPU#|User Time(%)|System Time(%)|Idle Time(%)|Usage(%)|Run queue|Interrupts/sec|
---------------------------------------------------------------------------------
| 1| 1| 10| 89| 11| ?| 143745|
| 2| 1| 10| 89| 11| ?| 143745|
| 3| 1| 10| 89| 11| ?| 143745|
| 4| 1| 10| 89| 11| ?| 143746|
---------------------------------------------------------------------------------

this is not our heavy period, so overall usage is lower, but for me, the important thing is that its balanced.

I appreciate that this is a lower-powered solution than the PFSense, we are expecting higher overall CPU usage which we can accept, we just need it to use all 4 cores not just 1-2 as it was before.

Thanks for your assistance!

Re: CPU Core Usage Imbalance

Wolfgang — Sat, 19 Feb 2022 17:21:33 GMT

Really interesting to see the results with all 4 instances. Never tried such a configuration but with your traffic profile this should be the best solution. But you will have a look nothing changes, you‘ll get in trouble with such configuration if enabling additional blades or traffic changes.

Re: CPU Core Usage Imbalance

Greatsamps — Sun, 20 Feb 2022 07:02:07 GMT

Yes will keep a close eye on it. Is there any sort of best practice in terms of max CPU usage to permit. For example, if say the usage is consistently over say 75% should that be the point to look at upgrading to more cores?

Re: CPU Core Usage Imbalance

Timothy_Hall — Mon, 21 Feb 2022 01:24:52 GMT

Not really, as long as you don't have cores hitting 100% utilization frequently it really isn't an issue. An informal tuning goal mentioned in my book is to have an average utilization of roughly 50% across all cores during the firewall's busiest period, but that is just a guideline to know when further tuning efforts are likely past the point of diminishing returns vs. the time spent analyzing and implementing them. As Wolfgang said should you enable any blades that require Medium Path or F2F processing in the future, your performance is very likely to tank with your 4/4 split on 4 cores.