Solved: Stealthwatch Flow Sensor high CPU usage

Vishnu_RR · ‎09-04-2023

Hi guys,

The FS is capturing the traffic from the Switch with the help of the SPAN protocol. Few CPU cores show the CPU utilization close to 90%.

This usage is in the range of 82%-90% always. So I just want to know if is this normal behavior or if I need to take some action. This physical appliance with model 3210.

lohan · ‎09-19-2023

Hi Vishnu_RR,

First of all, if you can create a TAC case to earn professional assistance, it would be really help.

And then, since you have mention that "This usage is in the range of 82%-90% always"

I would like suggest you consider upgrading hardware or optimizing configurations:
If the high CPU utilization is negatively impacting performance, it may be necessary to upgrade the hardware to a more powerful model or optimize configurations to reduce the load on the CPU.

This could involve adjusting traffic capture settings, tuning the SPAN protocol, or redistributing traffic flows.

-----------------------------------------
If you find my reply solved your question or issue, kindly click the 'Accept as Solution' button and vote it as helpful.

You can also learn more about Secure Network Analytics (formerly known as Stealthwatch) through our live Ask the Experts (ATXs) session. Check out Cisco Network Security ATXs Resources [https://community.cisco.com/t5/security-knowledge-base/cisco-network-security-ask-the-experts-resources/ta-p/4416493] to view the latest schedule for upcoming sessions, as well as the useful references, e.g. online guides, FAQs.
-----------------------------------------

Best Regards,
Henry

View solution in original post

lohan · ‎09-19-2023

Hi Vishnu_RR,

First of all, if you can create a TAC case to earn professional assistance, it would be really help.

And then, since you have mention that "This usage is in the range of 82%-90% always"

I would like suggest you consider upgrading hardware or optimizing configurations:
If the high CPU utilization is negatively impacting performance, it may be necessary to upgrade the hardware to a more powerful model or optimize configurations to reduce the load on the CPU.

This could involve adjusting traffic capture settings, tuning the SPAN protocol, or redistributing traffic flows.

-----------------------------------------
If you find my reply solved your question or issue, kindly click the 'Accept as Solution' button and vote it as helpful.

You can also learn more about Secure Network Analytics (formerly known as Stealthwatch) through our live Ask the Experts (ATXs) session. Check out Cisco Network Security ATXs Resources [https://community.cisco.com/t5/security-knowledge-base/cisco-network-security-ask-the-experts-resources/ta-p/4416493] to view the latest schedule for upcoming sessions, as well as the useful references, e.g. online guides, FAQs.
-----------------------------------------

Best Regards,
Henry