CPU high load during specific time periods

F5 AWAF/ASM uses now anacron Overview of anacron utility on the BIG-IP system that can cause such behavior as it is more random. Usually datasyncd or Obfuscator  is the cause datasyncd consuming a lot of CPU after upgrade / High CPU utilization for longer hours after changing the Obfuscation Schedule /ASM shows heavy CPU use due to Obfuscator process 

High CPU load on your BIG-IP ASM (Application Security Manager) during specific time periods can be caused by several factors, even if traffic is not high. Here are some potential causes and troubleshooting steps:

1. Datasyncd Process: The datasyncd process, which manages JavaScript obfuscation and other protection features, can cause temporary spikes in CPU usage. This process runs daily and can be rescheduled if it impacts performance.
2. Policy Learning and Signature Checking: Enabling policy learning and signature checking can increase CPU load. These features analyze traffic and apply security policies, which can be resource-intensive.
3. Behavioral Detection and Bot Defense: Features like behavioral detection and bot defense profiles can also contribute to higher CPU usage. These features analyze user behavior and detect potential threats.
4. Remote Logging: If you have remote logging enabled for request logs, it can increase CPU load, especially if the logs are large or the logging frequency is high.
5. Large POST Requests: Handling large POST requests can be CPU-intensive, particularly if the requests contain a lot of data that needs to be processed.

Recommended Actions

• Reschedule Datasyncd Process: Adjust the daily start time for the datasyncd process to a period of lower activity. This can be done via the Configuration utility under Security > Options > Background Tasks.
• Review Policies and Features: Evaluate the necessity of features like policy learning, signature checking, behavioral detection, and bot defense. Disabling or optimizing these features can reduce CPU load.
• Optimize Logging: Consider reducing the frequency or size of remote logs, or disabling remote logging if it's not essential.
• Monitor Specific Processes: Use tools like tmsh to monitor specific processes and identify which ones are consuming the most CPU.

If these steps do not resolve the issue, it may be helpful to contact F5 Support for further assistance.

 Investigating Reasons for High CPU Utilization on ASM provisioned BIG-IP [2]: Troubleshooting high CPU utilisation on BIG-IP systems

References

[1] Investigating Reasons for High CPU Utilization on ASM provisioned BIG-IP

[2] Troubleshooting high CPU utilisation on BIG-IP systems

Any luck AbdumalikImyaminov  with discovering the issue? Also I may not be a fan of chatgpt as people need to have good F5 knowledge before using it answer their questions or provide answers. But  outside of that in this case the latest version streamlines the suggestions in nice format, so you can use for faster resolution than by going from article to article. As I know my stuff after checking it's reply it seems good in this case 😉