CPU high load during specific time periods

High CPU load on your BIG-IP ASM (Application Security Manager) during specific time periods can be caused by several factors, even if traffic is not high. Here are some potential causes and troubleshooting steps:

1. Datasyncd Process: The datasyncd process, which manages JavaScript obfuscation and other protection features, can cause temporary spikes in CPU usage. This process runs daily and can be rescheduled if it impacts performance.
2. Policy Learning and Signature Checking: Enabling policy learning and signature checking can increase CPU load. These features analyze traffic and apply security policies, which can be resource-intensive.
3. Behavioral Detection and Bot Defense: Features like behavioral detection and bot defense profiles can also contribute to higher CPU usage. These features analyze user behavior and detect potential threats.
4. Remote Logging: If you have remote logging enabled for request logs, it can increase CPU load, especially if the logs are large or the logging frequency is high.
5. Large POST Requests: Handling large POST requests can be CPU-intensive, particularly if the requests contain a lot of data that needs to be processed.

Recommended Actions

• Reschedule Datasyncd Process: Adjust the daily start time for the datasyncd process to a period of lower activity. This can be done via the Configuration utility under Security > Options > Background Tasks.
• Review Policies and Features: Evaluate the necessity of features like policy learning, signature checking, behavioral detection, and bot defense. Disabling or optimizing these features can reduce CPU load.
• Optimize Logging: Consider reducing the frequency or size of remote logs, or disabling remote logging if it's not essential.
• Monitor Specific Processes: Use tools like tmsh to monitor specific processes and identify which ones are consuming the most CPU.

If these steps do not resolve the issue, it may be helpful to contact F5 Support for further assistance.

 Investigating Reasons for High CPU Utilization on ASM provisioned BIG-IP [2]: Troubleshooting high CPU utilisation on BIG-IP systems

References

[1] Investigating Reasons for High CPU Utilization on ASM provisioned BIG-IP

[2] Troubleshooting high CPU utilisation on BIG-IP systems