topic Re: CPU high? in General Topics

CPU high?

RemoteUser — Fri, 04 Apr 2025 13:34:57 GMT

when should I start worrying if the CPU is high and can cause firewall problems?

Re: CPU high?

the_rock — Fri, 04 Apr 2025 13:39:36 GMT

Personally, and this is just my honest opinion, I generally start looking into things if it goes over 70% and I have that mentality for ANY fw vendor, not just CP.

Andy

Re: CPU high?

RemoteUser — Fri, 04 Apr 2025 13:55:08 GMT

In my firewall it's very high so

Re: CPU high?

the_rock — Fri, 04 Apr 2025 13:56:37 GMT

O wow, thats bad. Seems possibly related to corexl. What do top and ps -auxw show?

Andy

Re: CPU high?

RemoteUser — Fri, 04 Apr 2025 13:57:25 GMT

ps -auxw
PID TTY TIME CMD
53303 pts/2 00:00:00 ps

Re: CPU high?

RemoteUser — Fri, 04 Apr 2025 14:02:22 GMT

what is the purpose of this command? (ps -auxw)
what is the purpose of this? (fwk0_dev_0)

Re: CPU high?

RemoteUser — Fri, 04 Apr 2025 14:03:56 GMT

this is the appliance:
Platform: QM-35-00
Model: Check Point 7000
CPU Model: Intel(R) Xeon(R) Silver 4216 CPU
CPU Frequency: 2100.000 Mhz
Number of Cores: 32
CPU Hyperthreading: Enabled

Re: CPU high?

the_rock — Fri, 04 Apr 2025 14:04:25 GMT

ps -auxw would show all the processes and what they are "consuming"

Andy

Re: CPU high?

PhoneBoy — Fri, 04 Apr 2025 22:21:39 GMT

We need to see the output of "Super Seven" to see what needs to be done here.
https://community.checkpoint.com/t5/Scripts/S7PAC-Super-Seven-Performance-Assessment-Commands/m-p/40528?search-action-id=118309679761&search-result-uid=40528

Re: CPU high?

the_rock — Fri, 04 Apr 2025 23:01:19 GMT

From ps -auxw, what is consuming most CPU?

Andy

Re: CPU high?

Timothy_Hall — Sat, 05 Apr 2025 13:54:25 GMT

This is expected behavior on a firewall in USFW mode (which all modern ones are). That fwk0_dev_0 process is the lead process for all your firewall worker instance threads which handle medium path, slowpath, & rule base lookups among other things which consume significant CPU resources. See here from my Gateway Performance Optimization course:

Re: CPU high?

the_rock — Sat, 05 Apr 2025 16:53:28 GMT

But would it be normal to show 465% though??

Andy

Re: CPU high?

Machine_Head — Sat, 05 Apr 2025 17:01:35 GMT

Yeah because in USFW it's multithreaded so 465% doesnt mean it's using 465% of 1 core and hogging it.

Re: CPU high?

the_rock — Sat, 05 Apr 2025 17:04:05 GMT

K, fair enough. I was just little surprised to see that high of a number, caught me off guard. I would definitely verify the real numbers by running cpview and maybe also check the history with t flag.

Andy

Re: CPU high?

genisis__ — Sun, 06 Apr 2025 09:34:11 GMT

I agree, however if the appliance resources are monitored correctly, and over time, you would easily know what is deemed normal traffic, and this would trigger an investigation.

I tend to aim for 50 - 60% peak CPU utilization, during the working week, if it goes above this, and when it does it tends to be pretty obvious I would be all over it.
In past cases it generally some new service that's been rolled out that's not working correctly or another country going through the UK firewalls to reach the internet as an example when they should be going out there local country POP.

CPView can help to determine to IPs, and I know there are utilities on checkmates (Phoneboy has mentioned this in later comments) that can help define top ten IP as example, equal NMS's monitoring the appliances could glean this information via SNMP as well.

Re: CPU high?

the_rock — Sat, 05 Apr 2025 18:02:05 GMT

Yep... @RemoteUser , see if running below command returns anything, might help.

Andy

fw ctl multik print_heavy_conn

Re: CPU high?

genisis__ — Sat, 05 Apr 2025 21:13:36 GMT

another good command.

Re: CPU high?

RemoteUser — Sun, 06 Apr 2025 10:23:57 GMT

fw ctl multik print_heavy_conn:

Re: CPU high?

the_rock — Sun, 06 Apr 2025 11:42:22 GMT

See if maybe terminating some of those would help.

Andy

Re: CPU high?

Timothy_Hall — Sun, 06 Apr 2025 14:22:54 GMT

Uh most of those elephant flows lasted 2-3 seconds, not even long enough for Hyperflow to kick in. The longest elephant flow in your output lasted 12 seconds, not enough to cause sustained high CPU usage in your Firewall Worker Instances. Please provide the outputs from the Super Seven as requested earlier so we can make a concrete determination and not just engage in more idle speculation. I suspect you may have a lot of F2F/slowpath traffic.

https://community.checkpoint.com/t5/Scripts/S7PAC-Super-Seven-Performance-Assessment-Commands/m-p/40528