FMCv 7.2.5.1: High CPU load - how to troubleshoot?

[swscco001]

Hello everybody,

our customer has a FMCv running sugg. rel. 7.2.5.1 and has a high CPU load of approx. 97%.
(see attached screen dump).

The VM has 4 CPUs, 32GB RAM and 250GB HDD.

The FMC is managing a HA of two Firepower 1120 running rel. 7.2.5.

A FMC reboot does not solve the issue.

A "Run All" in the Health Monitor does not solve the issue.

The DBCheck.pl does not show any error (see attached output).

What could be the reason of the high CPU load and how can
we get rid of?

Thanks a lot for every hint!




Bye
R.

[Jon Are Endrerud]

When logging into CLI --> expert, what is the "top" command say about the processes using cpu ?

[Marvin Rhoads]

@swscco001  In addition to the "top" command suggested by @Jon Are Endrerud , you can also check the Events/Second coming in to the FMC in the Health Monitor (may need to switch to the new light UI under your user profile).

[Marius Gunnerud]

I have seen a few of these High CPU issues on post 7.2.x versions of FTD.  In the worst cases we had to reload the FTD as the CLI was unresponsive.  In each of these scenarios the underlying issue was always a bug and is fixed with an upgrade to newer version.

Other possible scenarios could be excessive logging and IPS that is triggering on a lot of packets (not necessarily because of an attack).

Commands you could use to identify what is  causing the high CPU:

show cpu core all

show processes cpu-usage non-zero

show cpu usage-hog

Expert mode: top

[swscco001]

Hello everybody,

with the FMC upgrade to rel. 7.2.6 the high CPU load disappeared.

Thanks a lot!



Bye
R.

[Marius Gunnerud]

I am glad the upgrade to 7.2.6 solved the issue for you.  However, for you and anyone else that finds this post, be aware of the following bug that can cause the FTD to go into a boot loop if you are using SNMP.  

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwi63113