CPU high?

[RemoteUser]

when should I start worrying if the CPU is high and can cause firewall problems?

[the_rock]

Personally, and this is just my honest opinion, I generally start looking into things if it goes over 70% and I have that mentality for ANY fw vendor, not just CP.

Andy

[RemoteUser]

In my firewall it's very high so

[the_rock]

O wow, thats bad. Seems possibly related to corexl. What do top and ps -auxw show?

Andy

[RemoteUser]

ps -auxw
PID TTY TIME CMD
53303 pts/2 00:00:00 ps

[RemoteUser]

what is the purpose of this command? (ps -auxw)
what is the purpose of this? (fwk0_dev_0)

[RemoteUser]

this is the appliance:
Platform: QM-35-00
Model: Check Point 7000
CPU Model: Intel(R) Xeon(R) Silver 4216 CPU
CPU Frequency: 2100.000 Mhz
Number of Cores: 32
CPU Hyperthreading: Enabled

[the_rock]

ps -auxw would show all the processes and what they are "consuming"

Andy

[the_rock]

From ps -auxw, what is consuming most CPU?

Andy

[Timothy_Hall]

This is expected behavior on a firewall in USFW mode (which all modern ones are).  That fwk0_dev_0 process is the lead process for all your firewall worker instance threads which handle medium path, slowpath, & rule base lookups among other things which consume significant CPU resources.  See here from my Gateway Performance Optimization course:

[the_rock]

But would it be normal to show 465% though??

Andy

[Machine_Head]

Yeah because in USFW it's multithreaded so 465% doesnt mean it's using 465% of 1 core and hogging it.

[the_rock]

K, fair enough. I was just little surprised to see that high of a number, caught me off guard. I would definitely verify the real numbers by running cpview and maybe also check the history with t flag.

Andy

[genisis__]

I agree, however if the appliance resources are monitored correctly, and over time, you would easily know what is deemed normal traffic, and this would trigger an investigation.

I tend to aim for 50 - 60% peak CPU utilization, during the working week,  if it goes above this, and when it does it tends to be pretty obvious I would be all over it.
In past cases it generally some new service that's been rolled out that's not working correctly or another country going through the UK firewalls to reach the internet as an example when they should be going out there local country POP.

CPView can help to determine to IPs, and I know there are utilities on checkmates (Phoneboy has mentioned this in later comments) that can help define top ten IP as example, equal NMS's monitoring the appliances could glean this information via SNMP as well.

[the_rock]

Yep... @RemoteUser , see if running below command returns anything, might help.

Andy

fw ctl multik print_heavy_conn

[genisis__]

another good command.

[RemoteUser]

fw ctl multik print_heavy_conn:

[the_rock]

See if maybe terminating some of those would help.

Andy

[Timothy_Hall]

Uh most of those elephant flows lasted 2-3 seconds, not even long enough for Hyperflow to kick in.  The longest elephant flow in your output lasted 12 seconds, not enough to cause sustained high CPU usage in your Firewall Worker Instances.  Please provide the outputs from the Super Seven as requested earlier so we can make a concrete determination and not just engage in more idle speculation.  I suspect you may have a lot of F2F/slowpath traffic.

https://community.checkpoint.com/t5/Scripts/S7PAC-Super-Seven-Performance-Assessment-Commands/m-p/40...

[PhoneBoy]

We need to see the output of "Super Seven" to see what needs to be done here.
https://community.checkpoint.com/t5/Scripts/S7PAC-Super-Seven-Performance-Assessment-Commands/m-p/40...