- CheckMates
- :
- Products
- :
- General Topics
- :
- Audit high CPU
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Mute
- Printer Friendly Page
Are you a member of CheckMates?
×- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Audit high CPU
Hello, everybody.
Do you know if it is possible to "investigate" the "root-cause" of a high CPU consumption of a GW (which is part of a Cluster), weeks ago?
I have a customer, who for some strange reason, wants to know, why his CPU "shot" in terms of consumption, but about 6 weeks ago.
Is it possible to check this?
Thanks for your comments.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Gather a CPinfo & HCP and review them with TAC based on the specific incident time line.
Hopefully there is data/clues for the period in question.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It's sort of possible. Check out the description of cpview in sk101878. Specifically, you can use cpview's history logging to view some information from previous dates. This functionality is enabled by default on recent versions, but was not enabled by default on older versions. It also has limitations. For example, it samples every few minutes, so a spike between two samples may not be visible.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The cpview (via the -t historical mode) and sar commands automatically maintain 30 days of historical data. Further back than that you will need to rely on logfiles assuming they have not already rolled off such as:
/var/log/messages*
/var/log/spike_detective/spike_detective.log
If you have the monitoring blade enabled with the right options on your gateway you can also try a System Counters...Firewall History or System Counters...System History report and set the timeframe for "since system installed". You may be able to also construct a custom SmartView Monitor historical report that goes back more than 30 days. Beyond that there isn't much else to look at if you need to go back more than 30 days unless you have SmartEvent.
now available at maxpowerfirewalls.com