Create a Post
Showing results for 
Search instead for 
Did you mean: 

Audit high CPU

Hello, everybody.


Do you know if it is possible to "investigate" the "root-cause" of a high CPU consumption of a GW (which is part of a Cluster), weeks ago?


I have a customer, who for some strange reason, wants to know, why his CPU "shot" in terms of consumption, but about 6 weeks ago.


Is it possible to check this?


Thanks for your comments.


0 Kudos
3 Replies

Gather a CPinfo & HCP and review them with TAC based on the specific incident time line.

Hopefully there is data/clues for the period in question.


0 Kudos

It's sort of possible. Check out the description of cpview in sk101878. Specifically, you can use cpview's history logging to view some information from previous dates. This functionality is enabled by default on recent versions, but was not enabled by default on older versions. It also has limitations. For example, it samples every few minutes, so a spike between two samples may not be visible.

0 Kudos

The cpview (via the -t historical mode) and sar commands automatically maintain 30 days of historical data.  Further back than that you will need to rely on logfiles assuming they have not already rolled off such as:



If you have the monitoring blade enabled with the right options on your gateway you can also try a System Counters...Firewall History or System Counters...System History report and set the timeframe for "since system installed".  You may be able to also  construct a custom SmartView Monitor historical report that goes back more than 30 days.  Beyond that there isn't much else to look at if you need to go back more than 30 days unless you have SmartEvent.


Updated 2023 IPS/AV/ABOT R81.20 Course now
available at
0 Kudos


Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events