topic Re: Audit high CPU in General Topics

Audit high CPU

Matlu — Wed, 13 Sep 2023 13:57:18 GMT

Hello, everybody.

Do you know if it is possible to "investigate" the "root-cause" of a high CPU consumption of a GW (which is part of a Cluster), weeks ago?

I have a customer, who for some strange reason, wants to know, why his CPU "shot" in terms of consumption, but about 6 weeks ago.

Is it possible to check this?

Thanks for your comments.

Re: Audit high CPU

Chris_Atkinson — Wed, 13 Sep 2023 14:29:06 GMT

Gather a CPinfo & HCP and review them with TAC based on the specific incident time line.

Hopefully there is data/clues for the period in question.

Re: Audit high CPU

Bob_Zimmerman — Wed, 13 Sep 2023 14:34:13 GMT

It's sort of possible. Check out the description of cpview in sk101878. Specifically, you can use cpview's history logging to view some information from previous dates. This functionality is enabled by default on recent versions, but was not enabled by default on older versions. It also has limitations. For example, it samples every few minutes, so a spike between two samples may not be visible.

Re: Audit high CPU

Timothy_Hall — Wed, 13 Sep 2023 15:36:56 GMT

The cpview (via the -t historical mode) and sar commands automatically maintain 30 days of historical data. Further back than that you will need to rely on logfiles assuming they have not already rolled off such as:

/var/log/messages*

/var/log/spike_detective/spike_detective.log

If you have the monitoring blade enabled with the right options on your gateway you can also try a System Counters...Firewall History or System Counters...System History report and set the timeframe for "since system installed". You may be able to also construct a custom SmartView Monitor historical report that goes back more than 30 days. Beyond that there isn't much else to look at if you need to go back more than 30 days unless you have SmartEvent.