High CPU utilization (100%).

Forums Technical Forums
, , , , , , , , , ,
1

I observed high CPU utilization (100%) on F5 device, resource provision ASM nominal. I checked the client-side throughput and server-side throughput both are normal but found management interface throughput is very high and what i noticed this is happening in same time period for last 30 days. What could be the reason for this spike.

Many thanks in advanced for your time and consideration.

2

Hello @Militza ,

These articles might help: https://my.f5.com/manage/s/article/K40472403

myF5 it explains possible reasons and recommended actions.

3

Hi

How r u Militza?
Do you check the process into cli mode?

Best regards

José Labra.

4

Hi Jose,

i didn’t check the process into CLI but monitor from GUI CPU usage and throughout graph.

5

Hi Stan,

I have gone through with article but didn’t find anything with management interface traffic spike.

6

@Militza

From your question, it could be the ASM Obfuscation process. I found an article that could help answer your question on our <a href://my.f5.com>MyF5</a> portal, please click on the links below

K000137867: ASM shows heavy CPU use due to Obfuscator process

Hope this helps.

7

Hi akonu,

Thanks for your reply i checked the ASM obfuscation process timing it didn’t match with traffic spike timings.

8

do you enable AVR module and analytic profile is enabled in vserver(s)?
if yes, i suggest disable it for production traffic.

9

Hi zamroni,

AVR is not provisioned in the environment.

10

Hi Zamroni,

AVR is not provisioned in the environment.

11

Hi @Militza Can you post the results of running the top command here? You should see the exact process causing the spikes. It is most likely a control plane issue. Could be related to a lot of things, and the top command could help you drill down to the issue.

12

Below is the output of top command.

PID USER      PR  NI    VIRT    RES    SHR S  %CPU %MEM     TIME+ COMMAND
13842 root      20   0  107928    304    232 R  31.0  0.0   1:22.61 yes
16992 root      20   0  107928    348    276 R  31.0  0.0   0:26.81 yes
10151 root      20   0  167344   4588   2780 R  30.7  0.1   0:27.06 sshd
10152 root      20   0  167344   4596   2784 R  29.4  0.1   1:22.79 sshd

13

Hi Tofunmi, below is the output.

PID USER      PR  NI    VIRT    RES    SHR S  %CPU %MEM     TIME+ COMMAND
13842 root      20   0  107928    304    232 R  31.0  0.0   1:22.61 yes
16992 root      20   0  107928    348    276 R  31.0  0.0   0:26.81 yes
10151 root      20   0  167344   4588   2780 R  30.7  0.1   0:27.06 sshd
10152 root      20   0  167344   4596   2784 R  29.4  0.1   1:22.79 sshd

14

On the management interface, throughput is very high.

Does the BIG-IP’s non-floating self IP address have connectivity to the internet?

How are its routes configured? By default, connectivity for services such as Live Update, IP Intelligence, and others uses either a non-floating self IP address or the management IP address, depending on the corresponding route.

Live Update Automatic Installation:  The BIG-IP ASM system consults the Traffic Management Microkernel (TMM) and Linux routing tables when requesting attack signature updates using the Automatic Method. The source IP address for the resulting traffic uses either a non-floating self IP address or the management IP address, depending on the corresponding route. If internet access is not available for automatic updates, the system reports error messages in the configuration utility. link.

15

That are quite weird high cpu processes, the yes shouldn’t normally run, are there any scripts or such on it?

Have you tried a restart, does this output return then?

If you have support active contact F5 support and have them investigate the box.