High CPU usage on Standby

[Moudar]

Hi

On a standby gateway CPU usage is very high:

top - 10:37:14 up 21 days, 25 min,  1 user,  load average: 5.36, 5.60, 5.49
Tasks: 337 total,   2 running, 334 sleeping,   0 stopped,   1 zombie
%Cpu(s): 15.4 us, 19.1 sy,  0.0 ni, 44.8 id,  0.4 wa,  0.2 hi, 20.1 si,  0.0 st
KiB Mem : 16103484 total,  1141964 free,  5864284 used,  9097236 buff/cache
KiB Swap: 17542976 total, 17001792 free,   541184 used.  9319888 avail Mem

  PID USER      PR  NI    VIRT    RES    SHR S  %CPU %MEM     TIME+ COMMAND
21084 admin     20   0  317912  62812    608 S  82.8  0.4  10041:49 rsyslogd
 1361 admin      0 -20   59136   9936   7004 S  72.5  0.1   8722:00 routed
 1383 admin      0 -20   87512  13140   8548 S  57.0  0.1   7331:28 routed
30003 admin     20   0    5884   3328    676 S  36.4  0.0   4565:50 dhcpd
31828 admin     20   0 1126208 447572  30536 S   2.6  2.8 951:27.16 fw_full
24370 admin     20   0       0      0      0 S   1.0  0.0 152:56.99 fw_worker_0

All logging is happening on SMS, so wonder why rsyslogd is going crazy?

cpinfo -y all

This is Check Point CPinfo Build 914000250 for GAIA
[MGMT]
        HOTFIX_R81_20_JUMBO_HF_MAIN     Take:  98
[IDA]

R81.20

[Chris_Atkinson]

Are you seeing "routed" as responsible for a lot of log messages?

If there isn't a routing issue to be addressed then I would check if the issue persists following a reboot of the standby member.

Beyond that may need to be reviewed with TAC.

[Moudar]

After a restart CPU is 2% so I will have an eye on it. I still wonder why it did that?

[the_rock]

I would also make sure nothing changed in $FWDIR/conf/masters file

Andy

[Lesley]

Is there any clue in the syslog output itself? I assume you send the syslog towards syslog servers. What messages have been received there? Or you send syslog also towards SMS? 

Any  custom changes made to? :

/etc/rsyslog.conf
/etc/sysconfig/rsyslog

Maybe something occured on the system that triggered loads of syslog messages and that caused high cpu.