SRX

Can anybody help me to understand the below logs. have seen high CPU on SRX 3600 and kernal was utilizating 75 percent of the processes. Below logs were captured by SRX. Not able to see the process extensive as this ocur in the past. Please help me to understand below logs.

Sep 21 06:46:27   /kernel: netdaemon: excessive interrupt rate, slept 9520 ticks
Sep 21 08:51:38   /kernel: ###rdp_usr_detach tcb NULL socket 0xa4b60820

Hi eguanih,

Regarding the error athat you are seeing, below is the explanation for the same;

When a user run 'show security flow session', a request message will be sent to Flow SPU. Flow SPU sends all the active flow sessions information to RE via TNP packets.
When RE receives the TNP packets, interrupt notifies netDaemon to handle them. netDaemon will process the TNP packets and also do rate limitation check.
If it takes a long time (100 ticks) for netDaemon keeps processing packets, netDaemon will sleep for a while so that other Daemons have chance to run. This would result in netDaemon to sleep and internal connection between the RE (routing engine) and PFE (packet forwarding engine) was closed from 15:28:49 to 16:55:07. These were the reasons for
high CPU usage.

Please refer the KB article explaining [SRX] Control Plane CPU is high ("Idle 0 percent") after "show security flow session" command is issued : http://kb.juniper.net/KB28956

So that means, because of the flow session cmd, the cpu went high. And is it fine to have this or its an alarming situation like need some upgradation in the node.

What is the version of Junos you are running on the device?

Its haivng 12.1X44-D45.2.

1 more query how calculated below bold part?

This would result in netDaemon to sleep and internal connection between the RE (routing engine) and PFE (packet forwarding engine) was closed from 15:28:49 to 16:55:07.

If the CPU is stuck at 0% idle for long then it will be of concern and we would actually need to investigate the same.

I would suggest open a case with JTAc for the same if it is persistent.

Regarding the bold part it was typo what I meant was between 06:46:27and  08:51:38