CPU Usage inconsistency

[lmorocz]

Hello All,

Since the R81.20 upgrade, my gateways' CPU usage shows really different numbers in CPView, TOP and SmartConsole.
It seems inconsistent, SmartConsole shows around 4%, TOP shows 2,5% and CPView shows 45%.

I'm aware of that the TOP shows the cumulative value of CPVIEWs "User" and "System" column of a CPU.That’s why I was looking at the Idle % instead (and based the numbers on it above.)

I set the refresh rate of CPView to 1s.

R81.20 Take 631

Which one to trust? I know there were slight differences because of polling intervals/methods/magic, but that number seems to be way off.

Thanks for your help!

[Elad_Chomsky]

Hi @lmorocz , this seems like an issue on CPView, please open a ticket to Check Point through the official channels, so we can investigate and assist you on this issue.

Please also review the jumbo release notes, https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.20/R81.20/Take_26.htm?tocpath=_____4, it might be a known issue that was fixed already.

[the_rock]

As @Elad_Chomsky said, TAC could confirm all this, but I had seen this behavior ever since base R80, so to me, I just assume its normal.

In all honesty, everyone who ever used CP at all, knows that SV monitor is not overly reliable, so gui values can fluctuate and not be super accurate, thus I rely way more on top and ps -auxw outputs, as well as cpview.

Andy

[Marcel_Gramalla]

I can confirm the issue after updating to R81.20 (JHF 26) on two Clusters and also on the SMS and dedicated LogServer etc.. The GUI (SmartConsole) shows completely weird and wrong values. CPview and SNMP values are correct. My Cluster members most of the time show 0-5% usage instead of like 40-60% overall. OpenServer in my case and all existing cores are also licensed and used. It even shows 100% sometimes randomly on the systems.

Definitely a bug.

[lmorocz]

Yes, I've seen it at multiple places too and I've opened a TAC case for it too.

[the_rock]

I have jumbo 38 R81.20 in all my labs and I just verified 7 out of 10 devices and they all match EXACTLY, when you compare cpview and smart console.

Maybe its just my luck, but I find it would be too coincidental...

Andy

[ERTK]

hi,

we just upgrade a cluster to R81.20 version with j41 and we got the same behaviour. SmartConsole shows cpu usage of 0% meanwhile cpview shows an average of 22%. Anyone got to solve it?

thanks in advanced

[lmorocz]

Hello,

The TAC confirmed that it got fixed in JHF43 (I think they refer to it as "PRJ-46482, PRHF-28857" - but might be wrong on that).
But I've tested in a virtual lab and it indeed working fine now.

Hope it helps others as well.
Levente

[lmorocz · Accepted solution]

Hello All!

The TAC confirmed that it got fixed in JHF43 (I think they refer to it as "PRJ-46482, PRHF-28857" - but might be wrong on that).
But I've tested in a virtual lab and it indeed working fine now.

Hope it helps others as well.
Levente

[Kryten]

Running on R81.20 HFT 92 here and I still see this isse:

- SC shows ~20% less usage than I see in snmp monitoring or via CLI. 

- cpview shows SND instances on core 0 and 1 as mostly idle, while I see these cores with 80-90% usage in top. 

[PhoneBoy]

If the system is in UPPAK mode, this is likely normal (specifically the outside usage in top).

[Timothy_Hall]

As Phoneboy said this is expected behavior on a Lightspeed or Quantum Force appliance due to UPPAK.  My Vegas presentation discusses UPPAK and what to expect when you start working with it; this exact behavior is one of the topics.

[Kryten]

Thanks guys, good to know that this is expected....I still wonder though why it is like this...so I will definitely watch that presentation once its online 🙂 (won't attend CPX this year myself)

We switched from 6000 series to 9000 series and are now running with USFW/UPPAK. The switch brought some surpises, which we are still working on...

[PhoneBoy]

The TL;DR of it:

• In UPPAK mode, the NIC drivers are put into something called Poll Mode (versus Interrupt Mode of KPPAK)
• In Poll Mode, the standard Linux tools like ps, top, and htop will show high CPU when some Check Point specific tools like cpview show much lower usage.

[Kryten]

Alright, that is already helpful in understanding the difference, thanks!