cpu detective and SND congestion

[Luis_Miguel_Mig]

I have just noticed that the CPU detective is only designed to capture elephant flows if the FW worker is the problem.
If the SND process is congested then the CPU detective doesn't capture heavy connections.

sk166454 article is consistent what it has been described above.

I was wondering if someone knows how to workaround this constrain

I think it make sense and it would be very useful if we could find heavy connection if the SND is congested.

[AkosBakos]

Hi @Luis_Miguel_Mig 

And what about spike_detective?

I usually use this to determinate the high CPU usage on the GW.

Search for this string in the /var/log/messages.

akos

[AkosBakos]

Hi @Luis_Miguel_Mig 

And one more really useful command: fw ctl multik print_heavy_conn

https://support.checkpoint.com/results/sk/sk178070

Maybe it can help.

Akos

[the_rock]

I had seen Tim Hall give that command many times, its great!

Andy

[Timothy_Hall]

On a Quantum Force (9000/19000/29000) or Lightspeed appliance, 100% CPU utilization on the SND cores (at least as reported by Linux-based tools such as vmstat or top) does not necessarily indicate congestion as UPPAK is enabled, which uses poll mode instead of interrupts to grab traffic for processing.

Please provide more information about your appliance model number and Jumbo HFA version.