SRX Services Gateway
Highlighted
SRX Services Gateway

High CPU on a SRX 100B

‎04-12-2018 02:50 AM

Hi everyone!

 

I have a very special problem on a SRX100B. Around the same time every day the CPU spikes and when I check the services I can see that eventd and rtlogd is around 30% each. This goes on for around 20 minutes before they go down to the normal, around 0-4%.

 

Software: 12.1X46-D72.2

 

This was with the old software also.

2 REPLIES 2
SRX Services Gateway

Re: High CPU on a SRX 100B

‎12-29-2018 03:52 AM
Hi,

Please let me know the syslog mode you are using , is it in event mode or stream mode?

Also share the outputs of:
show chassis routing-engine
Show system processes extensive
Show security monitoring performance spy

Thanks,
Jalaj
SRX Services Gateway

Re: High CPU on a SRX 100B

‎12-31-2018 08:06 PM

The most possible reason for rtlogd and eventd going high at same time is high rate of policy logging. Do you have "session-init"/"session-close" enabled on policy?

if so can you check the logs and see which policy is getting most hits during this High CPU period?

If its a default deny policy, we may need to check if some unwanted traffic/application is trying some kind of attacks.

 

 

Thanks,
Suraj
Please Mark My Solution Accepted if it Helped, Kudos are Appreciated too