Audit high CPU

[Matlu]

Hello, everybody.

Do you know if it is possible to "investigate" the "root-cause" of a high CPU consumption of a GW (which is part of a Cluster), weeks ago?

I have a customer, who for some strange reason, wants to know, why his CPU "shot" in terms of consumption, but about 6 weeks ago.

Is it possible to check this?

Thanks for your comments.

[Chris_Atkinson]

Gather a CPinfo & HCP and review them with TAC based on the specific incident time line.

Hopefully there is data/clues for the period in question.

[Bob_Zimmerman]

It's sort of possible. Check out the description of cpview in sk101878. Specifically, you can use cpview's history logging to view some information from previous dates. This functionality is enabled by default on recent versions, but was not enabled by default on older versions. It also has limitations. For example, it samples every few minutes, so a spike between two samples may not be visible.

[Timothy_Hall]

The cpview (via the -t historical mode) and sar commands automatically maintain 30 days of historical data.  Further back than that you will need to rely on logfiles assuming they have not already rolled off such as:

/var/log/messages*

/var/log/spike_detective/spike_detective.log

If you have the monitoring blade enabled with the right options on your gateway you can also try a System Counters...Firewall History or System Counters...System History report and set the timeframe for "since system installed".  You may be able to also  construct a custom SmartView Monitor historical report that goes back more than 30 days.  Beyond that there isn't much else to look at if you need to go back more than 30 days unless you have SmartEvent.