CPU Spike Issues caused by increase in Inspect Traffic to assets.msn.com

[Gregory_Link]

Beginning yesterday we started seeing really high CPU spikes on the active firewall in our cluster.  The only outlier I see is lots of inspect traffic to assets.msn.com .  Is anyone else seeing this?

[the_rock]

Do you have https inspection enabled? If so, try disable it and install policy, see if it makes any difference.

Andy

[Timothy_Hall]

Are individual cores getting spiked while others are relatively idle, or all CPUs spiking up more or less together?  If the former, see what the Spike Detective has to say: sk166454: CPU Spike Detective

In the latest Jumbo HFA versions it will even log elephant flows that can be tracked down after 24 hours, unlike fw ctl multik print_heavy_conn.