For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

AbdumalikImyaminov's avatar
AbdumalikImyaminov
Icon for Nimbostratus rankNimbostratus
Feb 14, 2025

CPU high load during specific time periods

In our Big IP ASM, the server CPU is operating at high load during specific time periods. I have checked and confirmed that cron jobs are running at different times.  Even though the traffic is not...
announcement
application delivery
devops
event
security
F5_Design_Engineer's avatar
F5_Design_Engineer
Icon for MVP rankMVP
Feb 17, 2025

High CPU load on your BIG-IP ASM (Application Security Manager) during specific time periods can be caused by several factors, even if traffic is not high. Here are some potential causes and troubleshooting steps:

  1. Datasyncd Process: The datasyncd process, which manages JavaScript obfuscation and other protection features, can cause temporary spikes in CPU usage. This process runs daily and can be rescheduled if it impacts performance.
  2. Policy Learning and Signature Checking: Enabling policy learning and signature checking can increase CPU load. These features analyze traffic and apply security policies, which can be resource-intensive.
  3. Behavioral Detection and Bot Defense: Features like behavioral detection and bot defense profiles can also contribute to higher CPU usage. These features analyze user behavior and detect potential threats.
  4. Remote Logging: If you have remote logging enabled for request logs, it can increase CPU load, especially if the logs are large or the logging frequency is high.
  5. Large POST Requests: Handling large POST requests can be CPU-intensive, particularly if the requests contain a lot of data that needs to be processed.

Recommended Actions

  • Reschedule Datasyncd Process: Adjust the daily start time for the datasyncd process to a period of lower activity. This can be done via the Configuration utility under Security > Options > Background Tasks.
  • Review Policies and Features: Evaluate the necessity of features like policy learning, signature checking, behavioral detection, and bot defense. Disabling or optimizing these features can reduce CPU load.
  • Optimize Logging: Consider reducing the frequency or size of remote logs, or disabling remote logging if it's not essential.
  • Monitor Specific Processes: Use tools like tmsh to monitor specific processes and identify which ones are consuming the most CPU.

If these steps do not resolve the issue, it may be helpful to contact F5 Support for further assistance.

 Investigating Reasons for High CPU Utilization on ASM provisioned BIG-IP [2]: Troubleshooting high CPU utilisation on BIG-IP systems


References

[1] Investigating Reasons for High CPU Utilization on ASM provisioned BIG-IP

[2] Troubleshooting high CPU utilisation on BIG-IP systems