topic CPU Usage inconsistency in Firewall and Security Management

CPU Usage inconsistency

lmorocz — Tue, 17 Oct 2023 14:15:39 GMT

Hello All,

Since the R81.20 upgrade, my gateways' CPU usage shows really different numbers in CPView, TOP and SmartConsole.
It seems inconsistent, SmartConsole shows around 4%, TOP shows 2,5% and CPView shows 45%.

I'm aware of that the TOP shows the cumulative value of CPVIEWs "User" and "System" column of a CPU.That’s why I was looking at the Idle % instead (and based the numbers on it above.)

I set the refresh rate of CPView to 1s.

R81.20 Take 631

Which one to trust? I know there were slight differences because of polling intervals/methods/magic, but that number seems to be way off.

Thanks for your help!

Re: CPU Usage inconsistency

Elad_Chomsky — Tue, 17 Oct 2023 17:19:53 GMT

Hi @lmorocz , this seems like an issue on CPView, please open a ticket to Check Point through the official channels, so we can investigate and assist you on this issue.

Please also review the jumbo release notes, https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.20/R81.20/Take_26.htm?tocpath=_____4, it might be a known issue that was fixed already.

Re: CPU Usage inconsistency

the_rock — Tue, 17 Oct 2023 19:25:29 GMT

As @Elad_Chomsky said, TAC could confirm all this, but I had seen this behavior ever since base R80, so to me, I just assume its normal.

In all honesty, everyone who ever used CP at all, knows that SV monitor is not overly reliable, so gui values can fluctuate and not be super accurate, thus I rely way more on top and ps -auxw outputs, as well as cpview.

Andy

Re: CPU Usage inconsistency

Marcel_Gramalla — Wed, 22 Nov 2023 11:51:14 GMT

I can confirm the issue after updating to R81.20 (JHF 26) on two Clusters and also on the SMS and dedicated LogServer etc.. The GUI (SmartConsole) shows completely weird and wrong values. CPview and SNMP values are correct. My Cluster members most of the time show 0-5% usage instead of like 40-60% overall. OpenServer in my case and all existing cores are also licensed and used. It even shows 100% sometimes randomly on the systems.

Definitely a bug.

Re: CPU Usage inconsistency

lmorocz — Wed, 22 Nov 2023 13:30:59 GMT

Yes, I've seen it at multiple places too and I've opened a TAC case for it too.

Re: CPU Usage inconsistency

the_rock — Wed, 22 Nov 2023 14:25:27 GMT

I have jumbo 38 R81.20 in all my labs and I just verified 7 out of 10 devices and they all match EXACTLY, when you compare cpview and smart console.

Maybe its just my luck, but I find it would be too coincidental...

Andy

Re: CPU Usage inconsistency

ERTK — Thu, 14 Dec 2023 10:35:44 GMT

hi,

we just upgrade a cluster to R81.20 version with j41 and we got the same behaviour. SmartConsole shows cpu usage of 0% meanwhile cpview shows an average of 22%. Anyone got to solve it?

thanks in advanced

Re: CPU Usage inconsistency

lmorocz — Thu, 08 Feb 2024 09:32:56 GMT

Hello All!

The TAC confirmed that it got fixed in JHF43 (I think they refer to it as "PRJ-46482, PRHF-28857" - but might be wrong on that).
But I've tested in a virtual lab and it indeed working fine now.

Hope it helps others as well.
Levente

Re: CPU Usage inconsistency

lmorocz — Thu, 08 Feb 2024 09:33:24 GMT

Hello,

The TAC confirmed that it got fixed in JHF43 (I think they refer to it as "PRJ-46482, PRHF-28857" - but might be wrong on that).
But I've tested in a virtual lab and it indeed working fine now.

Hope it helps others as well.
Levente

Re: CPU Usage inconsistency

Kryten — Thu, 30 Jan 2025 10:14:16 GMT

Running on R81.20 HFT 92 here and I still see this isse:

- SC shows ~20% less usage than I see in snmp monitoring or via CLI.

- cpview shows SND instances on core 0 and 1 as mostly idle, while I see these cores with 80-90% usage in top.

Re: CPU Usage inconsistency

PhoneBoy — Thu, 30 Jan 2025 16:01:26 GMT

If the system is in UPPAK mode, this is likely normal (specifically the outside usage in top).

Re: CPU Usage inconsistency

Timothy_Hall — Thu, 30 Jan 2025 16:17:23 GMT

As Phoneboy said this is expected behavior on a Lightspeed or Quantum Force appliance due to UPPAK. My Vegas presentation discusses UPPAK and what to expect when you start working with it; this exact behavior is one of the topics.

Re: CPU Usage inconsistency

Kryten — Fri, 31 Jan 2025 12:59:33 GMT

Thanks guys, good to know that this is expected....I still wonder though why it is like this...so I will definitely watch that presentation once its online 🙂 (won't attend CPX this year myself)

We switched from 6000 series to 9000 series and are now running with USFW/UPPAK. The switch brought some surpises, which we are still working on...

Re: CPU Usage inconsistency

PhoneBoy — Fri, 31 Jan 2025 18:41:43 GMT

The TL;DR of it:

In UPPAK mode, the NIC drivers are put into something called Poll Mode (versus Interrupt Mode of KPPAK)
In Poll Mode, the standard Linux tools like ps, top, and htop will show high CPU when some Check Point specific tools like cpview show much lower usage.

Re: CPU Usage inconsistency

Kryten — Wed, 12 Feb 2025 14:33:04 GMT

Alright, that is already helpful in understanding the difference, thanks!