topic Re: VSX FW1_dev 140% cpu. in General Topics

VSX FW1_dev 140% cpu.

Stan_Mazur — Mon, 06 Aug 2018 18:47:31 GMT

Is there a way to not accelerate service on SecureXL on VSX. The issue is I have a admin in VM team that kick's

off replication jobs(8-10 of them) and it pumping between 100 to 400 Mbps on service port ideafarm-door (902), which

seems to stay with FWK1-DEV. When I push policy to that device it fails, because it times out. So I have to reach

out to the admin to pause his jobs, so I can push policy. Everything else work fine. Is this VSX bug?

Re: VSX FW1_dev 140% cpu.

_Val_ — Mon, 06 Aug 2018 19:56:26 GMT

Firstly, yes, you can disable SecureXL on per VS basis using CLI "fwaccell off" command from a VS content. However, this will only add to your current issue, instead of resolving it.

Re: VSX FW1_dev 140% cpu.

Kaspars_Zibarts — Mon, 06 Aug 2018 21:37:25 GMT

Hi. It's not a bug, you just need to tweak CoreXL and SXL to meet traffic requirements. It could well be that system will be underpowered to deal with such traffic volume. Therefore, can you share top command output showing all 16 individual core utilisation when it happens? Just to see which cores are maxed out.

As Valeri said SXL is actually your friend in high volume traffic, it should help free up CPU usage.

Re: VSX FW1_dev 140% cpu.

Vladimir — Tue, 07 Aug 2018 00:34:59 GMT

Could it be an interface buffer size issue?

Re: VSX FW1_dev 140% cpu.

Kaspars_Zibarts — Tue, 07 Aug 2018 04:13:45 GMT

Don't think so but can't tell from logs provided. CoreXL allocation is not exactly right as cores 2 and 3 seems to be used for SXL and generic firewall tasks (except fwk). We need to see detailed CPU usage to make correct call

Re: VSX FW1_dev 140% cpu.

JanVC — Tue, 07 Aug 2018 09:06:08 GMT

fwk1_dev is the combination of the 4 cores allocated to this vs

while in top, press shift+h to show the individual threads (worker cores)

148% means 1.5 of the 4 assigned cores being used

Re: VSX FW1_dev 140% cpu.

Stan_Mazur — Thu, 09 Aug 2018 19:42:30 GMT

Check Point support conclusion is related MTU size on vs 1 interfaces. Where running 10g interface with MTU size 9000,according,to CP they our working

on Hotfix." The recommended hotfix was not yet ported to Take_317, the latest version was for Take_302. I tested this version and it is not compatible

with 317"

Re: VSX FW1_dev 140% cpu.

HeikoAnkenbrand — Sun, 18 Nov 2018 20:01:06 GMT

SecureXL "fwaccel off" does not have to be disabled on R80.20 to run "fw monitor". This is good for performance, so "fw monitor" does not affect performance any more.

More see here: R80.x Performance Tuning and Debug Tips – fw monitor

Regards

Heiko