For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Mostafa_Elsayed's avatar
Mostafa_Elsayed
Icon for Cirrus rankCirrus
Jun 22, 2021

Analysis and control High cpu

we have new implemented device but doesn't have any traffic yet,and we noticed that there is high cpu on control/analysis cpus , anyone have info. for that problem  
application delivery
ASM Advanced WAF
Mostafa_Elsayed's avatar
Mostafa_Elsayed
Icon for Cirrus rankCirrus
Jun 25, 2021

when i check top command i found tmm.0 is very high

Nikoolayy1's avatar
Nikoolayy1
Icon for MVP rankMVP
Jun 25, 2021

Just doing a top at a random time may not help you. TMM being high could be as you have too much traffic for your F5 model. Check this and run the script at a time window when you have seen the cpu to jump to confirm if the tmm is the only one that jumps and for other issues:

 

 

https://support.f5.com/csp/article/K40472403

 

 

 

You may also check this great community article:

 

 

https://devcentral.f5.com/s/articles/Troubleshooting-High-CPU-Utilisation-on-F5-boxes

 

 

 

 

If you see tha only the tmm is the issue from expiriance you may check the /var/log/ltm for many irule logs, ssl decrytions failed handshakes, TCP RST debug variables enabled etc. In other words to see what can you do to optimize the the device by resolving issues and stoping enabled debugs or irule logs. Also if you have the ASM module pload the qkview to f5 ihealth and under the tab Securiry review the CPU just for the ASM as the ASM causes many jumps. If it was CP leakage the CPU should stay high all the time so I think it is utilization. Also review the /var/log/kern log as it may have also helpfull info.