Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Matlu
Advisor

Audit high CPU

Hello, everybody.

 

Do you know if it is possible to "investigate" the "root-cause" of a high CPU consumption of a GW (which is part of a Cluster), weeks ago?

 

I have a customer, who for some strange reason, wants to know, why his CPU "shot" in terms of consumption, but about 6 weeks ago.

 

Is it possible to check this?

 

Thanks for your comments.

 

0 Kudos
3 Replies
Chris_Atkinson
Employee Employee
Employee

Gather a CPinfo & HCP and review them with TAC based on the specific incident time line.

Hopefully there is data/clues for the period in question.

 

CCSM R77/R80/ELITE
0 Kudos
Bob_Zimmerman
Authority
Authority

It's sort of possible. Check out the description of cpview in sk101878. Specifically, you can use cpview's history logging to view some information from previous dates. This functionality is enabled by default on recent versions, but was not enabled by default on older versions. It also has limitations. For example, it samples every few minutes, so a spike between two samples may not be visible.

0 Kudos
Timothy_Hall
Legend Legend
Legend

The cpview (via the -t historical mode) and sar commands automatically maintain 30 days of historical data.  Further back than that you will need to rely on logfiles assuming they have not already rolled off such as:

/var/log/messages*

/var/log/spike_detective/spike_detective.log

If you have the monitoring blade enabled with the right options on your gateway you can also try a System Counters...Firewall History or System Counters...System History report and set the timeframe for "since system installed".  You may be able to also  construct a custom SmartView Monitor historical report that goes back more than 30 days.  Beyond that there isn't much else to look at if you need to go back more than 30 days unless you have SmartEvent.

 

Gateway Performance Optimization R81.20 Course
now available at maxpowerfirewalls.com
0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events