Menu

Join the Conversation

To sign in, use your existing MySonicWall account. To create a free MySonicWall account click "Register".

Sign In Register

High CPU utilization

tejasshenaitejasshenai Newbie ✭
in Mid Range Firewalls
We SonicWall NSA 4600 running on 6.5.4.7.83 n.From the past few days the CPU utilization shows 100% and our internal network goes down frequently also end devices got freeze at that time.

Can you please assist me what are the causes and what are the solutions for the same.

Thank you.!
Category: Mid Range Firewalls
Reply

Answers

  • BWCBWC Cybersecurity Overlord ✭✭✭

    @tejasshenai does the CPU utilization goes down when you unplug X0 (assuming this is your internal network)? This might be adressed in 6.5.4.9-93n, I believe that I read something about load issues in the Release Notes.

    I had a similar case a while back when there was a network loop in the internal network (customer deployed a mini switch) and the interface got flooded and a NSA 4600 (what a coincidence) was overloaded.

    --Michael@BWC

  • tejasshenaitejasshenai Newbie ✭
    @BWC X0 is our internal network but we have not tried to unplug X0 during this.Need to check this during downtime.As in our network we have enabled RSTP on switches.

    Also from the TSR report it shows CPU utilization is 100% from past 15 days.
  • MitatOngeMitatOnge All-Knowing Sage ✭✭✭✭

    Hi @tejasshenai

    Could you check "diag show cpu" and "diag show processes" and "diag show multicore" on CLI. in additonaly share TASK PART OF TSR log.

  • AjishlalAjishlal Community Legend ✭✭✭✭✭

    Hi @tejasshenai

    If Analyser / GMS is connected with Firewall, just disconnect and observe it. as well as do the below steps to identify the issue.

    1) Disable logging for App Control Globally

    2) Change the logging level to " Notice".

    3) If not enabled the Logging App Control Globally, Check any category is enabled the logging.

    4) As per @BWC suggestion, If suspect any PC/Laptop/Switch making broadcast storm/flood attacks, Enable the flood protection feature for UDP, ICMP . Do not enable for WAN (Follow below KB)

    https://www.sonicwall.com/support/knowledge-base/udp-and-icmp-flood-protection/170503279224098/


  • tejasshenaitejasshenai Newbie ✭
    @Ajishlal Thank you sir.After your reply I have done first two steps and cpu utilization is dropped little bit in 60 minutes time frame but in 1 hr it showing 100% continuosly.All other option will check soon.

    Also I m observing that the Core 5,6,7 having more utilization than other.
  • MitatOngeMitatOnge All-Knowing Sage ✭✭✭✭
    @tejasshenai could you uncheck GAV TCP stream scan
Sign In or Register to comment.