High CPU usage in Miscellaneous on Edge SWG

Products

• ProxySG Software - SGOS

Issue/Introduction

The CPU Monitor on the Edge SWG (formerly ProxySG) is reporting high CPU utilization in the Miscellaneous process group.

Cause

The most common reasons for seeing high CPU usage in Misc are:

• Automatic updates for content filter downloads during peak traffic times
  
  All versions of 6.x include a safety mechanism that prevents the content-filtering download from taking more than 25% of the CPU in an effort to prevent outages or slow-downs during a download.  However, downloading the filters during peak traffic may still result in high utilization. For high CPU in Misc and the default settings for RTU, try disabling automatic updates and set a schedule between the hours of 12 am and 1 am.  After this change monitor the ProxySG to see if the high CPU continues to occur.
  
  
• Issues with access log uploads
  
  If the Edge SWG is configured to upload access logs to a server and there is an issue with the upload, this could result in a high CPU in Misc.

Resolution

Check the event logs on the Edge SWG to see if there is an issue with the access log uploads.  Also, use the Test Upload button in the access log configurations to see whether or not the upload works.

If a problem is found, verify the configurations on the Edge SWG for the access log upload.

Next steps

If you go through these steps and still have issues with high CPU utilization in the HTTP or FTP process group, open a ticket with Broadcom Support.

In addition to the details from the CPU Monitor, you may also be asked to provide the following:

SysInfo

• The SysInfo information should be captured after the CPU utilization has returned to normal, or after 20 minutes of high utilization for a persistent utilization spike.
• This information can be uploaded through the management console Maintenance tab or captured from the URL https://<proxy_ip>:8082/Sysinfo

Event log

• The Event Log should be captured after the CPU utilization has returned to normal or after 20 minutes of high utilization for a persistent utilization spike.
• This information can be uploaded through the management console Maintenance tab or captured from the URL https://<proxy_ip>:8082/Eventlog/Statistics

TCP users

While the CPU utilization is high, copy the output from the URL https://<proxy_ip>:8082/TCP/Users

SysInfo_stats snapshots

Configure snapshots on the Edge SWG to occur every five minutes (default is 60), and run for at least 20 minutes during the CPU spike.

Full core (optional)

Depending on the nature and symptoms of the high utilization issue, you may be asked to provide a full core dump of the Edge SWG (ProxySG).