Forum Discussion
Militza
Nimbostratus
NimbostratusHigh CPU utilization (100%).
I observed high CPU utilization (100%) on F5 device, resource provision ASM nominal. I checked the client-side throughput and server-side throughput both are normal but found management interface throughput is very high and what i noticed this is happening in same time period for last 30 days. What could be the reason for this spike.
Many thanks in advanced for your time and consideration.
Stan051Employee
Hello Militza,
These articles might help: https://my.f5.com/manage/s/article/K40472403
https://my.f5.com/manage/s/article/K35043645 it explains possible reasons and recommended actions.
MilitzaHi Stan,
I have gone through with article but didn’t find anything with management interface traffic spike.
- JoseLabra
MVP
Hi
How r u Militza?
Do you check the process into cli mode?https://my.f5.com/manage/s/article/K15468
https://my.f5.com/manage/s/article/K10234384
Best regards
José Labra.
- Militza
Hi Jose,
i didn’t check the process into CLI but monitor from GUI CPU usage and throughout graph.
- Militza
Below is the output of top command.
PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
13842 root 20 0 107928 304 232 R 31.0 0.0 1:22.61 yes
16992 root 20 0 107928 348 276 R 31.0 0.0 0:26.81 yes
10151 root 20 0 167344 4588 2780 R 30.7 0.1 0:27.06 sshd
10152 root 20 0 167344 4596 2784 R 29.4 0.1 1:22.79 sshd
akonuModerator
From your question, it could be the ASM Obfuscation process. I found an article that could help answer your question on our myf5 portal, please click on the links below
K000137867: ASM shows heavy CPU use due to Obfuscator process
https://my.f5.com/manage/s/article/K000137867
Hope this helps.
- Militza
Hi akonu,
Thanks for your reply i checked the ASM obfuscation process timing it didn’t match with traffic spike timings.
- zamroni777
Nacreous
do you enable AVR module and analytic profile is enabled in vserver(s)?
if yes, i suggest disable it for production traffic. - Militza
Hi Tofunmi, below is the output.
PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
13842 root 20 0 107928 304 232 R 31.0 0.0 1:22.61 yes
16992 root 20 0 107928 348 276 R 31.0 0.0 0:26.81 yes
10151 root 20 0 167344 4588 2780 R 30.7 0.1 0:27.06 sshd
10152 root 20 0 167344 4596 2784 R 29.4 0.1 1:22.79 sshd
- welinton_trigueiro
Cirrus
On the management interface, throughput is very high.
Does the BIG-IP's non-floating self IP address have connectivity to the internet?
How are its routes configured? By default, connectivity for services such as Live Update, IP Intelligence, and others uses either a non-floating self IP address or the management IP address, depending on the corresponding route.
Live Update Automatic Installation: The BIG-IP ASM system consults the Traffic Management Microkernel (TMM) and Linux routing tables when requesting attack signature updates using the Automatic Method. The source IP address for the resulting traffic uses either a non-floating self IP address or the management IP address, depending on the corresponding route. If internet access is not available for automatic updates, the system reports error messages in the configuration utility. link.
