High CPU utilization (100%).

On the management interface, throughput is very high.

Does the BIG-IP's non-floating self IP address have connectivity to the internet?

How are its routes configured? By default, connectivity for services such as Live Update, IP Intelligence, and others uses either a non-floating self IP address or the management IP address, depending on the corresponding route.

Live Update Automatic Installation:  The BIG-IP ASM system consults the Traffic Management Microkernel (TMM) and Linux routing tables when requesting attack signature updates using the Automatic Method. The source IP address for the resulting traffic uses either a non-floating self IP address or the management IP address, depending on the corresponding route. If internet access is not available for automatic updates, the system reports error messages in the configuration utility. link.

Hi Militza Can you post the results of running the top command here? You should see the exact process causing the spikes. It is most likely a control plane issue. Could be related to a lot of things, and the top command could help you drill down to the issue.

do you enable AVR module and analytic profile is enabled in vserver(s)?
if yes, i suggest disable it for production traffic.

Militza 

From your question, it could be the ASM Obfuscation process. I found an article that could help answer your question on our myf5 portal, please click on the links below

K000137867: ASM shows heavy CPU use due to Obfuscator process

https://my.f5.com/manage/s/article/K000137867

Hope this helps.

Hi

How r u Militza?
Do you check the process into cli mode?

https://my.f5.com/manage/s/article/K15468

https://my.f5.com/manage/s/article/K10234384

Best regards

José Labra.

Hello Militza,

These articles might help: https://my.f5.com/manage/s/article/K40472403

https://my.f5.com/manage/s/article/K35043645 it explains possible reasons and recommended actions.