High CPU in Analysis Plane

Question

Analysis plane CPU is high at 100% while overall CPU is 26%. tmm.0 at 110%, pabnagd 91%, bd 90%. CPU9 is at high cpu almost 100%. We have ltm+asm running over BIG-IP 12.1.2 Build 0.93.249 Engineering Hotfix.&nbsp;
Anyone with similar issue and suggestions please .&nbsp;

rafaelbn · Answer

Hello
I had a similar issue and posted here: https://devcentral.f5.com/questions/viprion-2400-with-2xb2150-20-30-active-connections-cpu0-at-100-59842.
I raised a ticket with F5 and after some troubleshooting, they cleared my box saying it was normal.
Check your CPU graphs and if you can, open a ticket with them. I think we have a very close build. My box was running code v12.1.2 1.0.271.
Can you paste the output of:
tmsh show ltm virtual | grep -e "Ltm::\|CMP\|CPU\|Last 5 Seconds"
Cheers!

algebraicmirror · Answer

Did you ever get an answer to this? I am running into the same thing today, with LTM+APM. Since it is just one CPU pegged, and if I recall correctly the Linux host OS is always pegged to one core, I'm guessing it's related to something running on Linux. Could it possibly be the act of running reports on the system? I was trying to run APM reports and it's a pretty busy box, but not sure if it's busy enough to account for this. Any ideas would be appreciated, as would be a good explanation of what the "analysis plane" is.&nbsp;

algebraicmirror · Answer

I did eventually figure this out. In my case, every spike in the "analysis plane" ended up being accounted for by someone running the APM "All Sessions" report for the last hour. We have so many sessions that running that report could spike the CPU. The solution for us to start doing this kind of analysis in Splunk (we already ship the logs there).&nbsp;
Based on this, I would guess you issue is caused by one of two things: running ASM reports, or ASM learning mode doing analysis on traffic.&nbsp;

dineshkumar1611 · Answer

Yes, absolutely right. It was because of ASM reports in Analysis plane. I logged a ticket with F5 Support and they suggested to ignore it as it will not impact the traffic.&nbsp;

Forum Discussion

F5 Container Ingress Services (CIS) and using k8s traffic policies to send traffic directly to pods

F5 Architecture Track Sessions - AppWorld 2026

Recent Discussions

Related Content

Differentiating between the BIG-IP data plane and control plane

NGINX App Protect Data Plane Add-on in Kubernetes

What is analysis plane. what are the reasons behind High CPU of Analysis plane?

Troubleshooting high CPU utilisation on BIG-IP systems

Dyre Malware Analysis

ABOUT DEVCENTRAL

RESOURCES

SUPPORT

PARTNERS