high CPU utilization on ip530

[saffa2005]

Hi,
'vmstat 1 10' on ipso shows cpu ave 95-100%
'netstat -w 1' shows average 10-30mb throughoutput..
'ps uaxw' show acumilated cpu aff approx 20%.

not sure what is using up my CPU power.. could it be traffic generated from an infected network / system. did the netstat on all my interfaces not seeing anything suspicious. about 20 vpns installed not much traffic either.. 1-2mb/s combined.

anyone know of commands i can use to troubleshoot this problem?

IPSO nok530-fw 3.8-BUILD039 releng 1404 07.23.2004-193500 i386

thanks in advance.

 

[rn4it]

If you connect to your IP530 using voyager, select monitoring, system utlization, process utilization this will tell you what process/services are being used at what percentages.

 

[saffa2005]

hi,
thanks for the reply much appreciated.
i have tried both voyager and checkpoint monitor.. forgot to mention.
within voayager if I add all the proccesses together it's no more that 30-40%.. but at the same time vmstat is reporting 99% on 'sy' process.
have 2 nokia 530's in a cluster.. if i failover to secondary problem persists. have restarted both firewalls same problem.
could it be a case of misreporting?

thanks in advance.

 

[rn4it]

I know in the past there was an issue with voyager reporting accuracy. Here's a a script I use on ours to see process who's memory or cpu are above 10%. If you wish to use it, please test it on a test system first, as well make sure you understand what it does.
FW[root]# more vmstatmon
#!/bin/csh
source /var/etc/pm_cshrc
setenv NAME `uname -n`
setenv DATE `date +%d%b%Y%`

#This program will monitor the usage of the swap file over time
#and list the top 10 processes hogging memory

#Save the output to this file
set output=/var/admin/$NAME-$DATE
set Dcheck=/var/admin/Daily$NAME-$DATE
#Number of processes to report on
set processnum=10

####################main program begin
#print the date
echo ooooooooooooooooooooooooooooooooooooooooooooooo>>! $output
date>>! $output
echo"">>! $output
#print the swap file usage
pstat -ks >>! $output
echo"">>! $output
#print the top process hogs
ps auxmw | head -${processnum}>>! $output
#Changes output file to a Daily check
echo oooooooooooooooooooooooooooooooooooooooooooooo>>! $Dcheck
echo"">>! $Dcheck
#prints processes that are above 10%
ps auxmw | head -10 |tail -10 | awk ' $4 >10 {print $1, $2, $3, $4, $10, $11}'>>
! $Dcheck
ps auxmw | head -10 |tail -10 | awk ' $3 >10 {print $1, $2, $3, $4, $10, $11}'>>
! $Dcheck

 

[kio91]

Hi!

What flavor of checkpoint are you using? r54 r55 r55w?
I know that rules that use resources eat a lot of cpu. That happens with email resorces and when a security server is activated by smart defense. Or Web Intelligence in r55w

There is a httpd process (i think) that is used by smart defense.

try ps -aux to see which process is using the cpu.

Good luck