topic Re: CPU Spike Issues caused by increase in Inspect Traffic to assets.msn.com in General Topics

CPU Spike Issues caused by increase in Inspect Traffic to assets.msn.com

Gregory_Link — Tue, 05 Dec 2023 20:46:29 GMT

Beginning yesterday we started seeing really high CPU spikes on the active firewall in our cluster. The only outlier I see is lots of inspect traffic to assets.msn.com . Is anyone else seeing this?

Re: CPU Spike Issues caused by increase in Inspect Traffic to assets.msn.com

the_rock — Tue, 05 Dec 2023 20:50:19 GMT

Do you have https inspection enabled? If so, try disable it and install policy, see if it makes any difference.

Andy

Re: CPU Spike Issues caused by increase in Inspect Traffic to assets.msn.com

Timothy_Hall — Wed, 06 Dec 2023 00:54:35 GMT

Are individual cores getting spiked while others are relatively idle, or all CPUs spiking up more or less together? If the former, see what the Spike Detective has to say: sk166454: CPU Spike Detective

In the latest Jumbo HFA versions it will even log elephant flows that can be tracked down after 24 hours, unlike fw ctl multik print_heavy_conn.