Forum Discussion
Mostafa_Elsayed
Cirrus
CirrusAnalysis and control High cpu
we have new implemented device but doesn't have any traffic yet,and we noticed that there is high cpu on control/analysis cpus , anyone have info. for that problem
jaikumar_f5MVP
Well from the snapshot, I could think of some daemon on the control plane is over utilizing the CPU.
And your tmm is under control, so i dont think its the traffic which would be causing it. Because when there's a huge traffic to be processed, the tmm daemon spike and goes above 80%. When this happens, the even cores where the tmm is running, starts to take use of the odd cores where the control processes are running.
But that's not the case in your picture, tmm is normal. So its not trying to use the odd cores.
I'd run the top command to check which process is consuming high CPU usage.
Followed by use the tmsh show sys proc-info, which would list all the processes running and the CPU utilization of it. This should give you a picture which process is consuming it more. Based on that, you can take an action if that process needs to be restarted or something else is going on with the box.
If its bigd daemon, its possible there is high L7 check monitoring happening, your box has hit the capacity limit. You might want to fix it by removing the ECDHE/DHE ciphers from the monitoring cipher suite.
There's lot to troubleshoot to find the fix, start with finding the process. Please keep us posted.
- Mostafa_Elsayed
when i check top command i found tmm.0 is very high
- Nikoolayy1
Just doing a top at a random time may not help you. TMM being high could be as you have too much traffic for your F5 model. Check this and run the script at a time window when you have seen the cpu to jump to confirm if the tmm is the only one that jumps and for other issues:
https://support.f5.com/csp/article/K40472403
You may also check this great community article:
https://devcentral.f5.com/s/articles/Troubleshooting-High-CPU-Utilisation-on-F5-boxes
If you see tha only the tmm is the issue from expiriance you may check the /var/log/ltm for many irule logs, ssl decrytions failed handshakes, TCP RST debug variables enabled etc. In other words to see what can you do to optimize the the device by resolving issues and stoping enabled debugs or irule logs. Also if you have the ASM module pload the qkview to f5 ihealth and under the tab Securiry review the CPU just for the ASM as the ASM causes many jumps. If it was CP leakage the CPU should stay high all the time so I think it is utilization. Also review the /var/log/kern log as it may have also helpfull info.
