Troubleshooting High CPU Utilization Issues on the ProxySG or Advanced Secure Gateway

Products

• Advanced Secure Gateway Software - ASG
• ProxySG Software - SGOS

Issue/Introduction

The troubleshooting and resolution of high CPU utilization issues on the ProxySG or Advanced Secure Gateway (ASG).

Resolution

This article provides the steps to troubleshoot utilization issues, with links to supporting procedures and common causes of high CPU utilization on the ProxySG or ASG.

Troubleshooting Considerations

To help identify the cause of the high CPU utilization, consider the following questions while progressing through the troubleshooting steps:

• Is the proxy continuously at high CPU, or does it peak at certain times?
• Does the CPU utilization come down after production hours?
• Does the CPU utilization peak periodically then go back to "normal"? If so, can you graph out the peaks, and identify a trend?
• Has anything recently changed in the environment that may have triggered the issue such as:
  • An increase in network traffic
  • New applications introduced
  • Configuration changes on the ProxySG or ASG or associated network devices
  • Etc.

Enable CPU Monitor

The first step to troubleshoot the issue is to enable the CPU monitor on the ProxySG or ASG and to activate snapshots every five minutes. This step helps determine which service or services generate the high utilization. The CPU monitor can be accessed at:

https://x.x.x.x:8082/Diagnostics/CPU_Monitor/statistics  

For more information on how to set up the CPU monitor, see: How to enable the CPU Monitor on the ProxySG

NOTE: Once you have finished taking snapshots, be sure to turn the CPU monitor off as it places additional CPU load on the system.

Review Common Causes for High CPU

After CPU Monitor identifies the source of the high CPU utilization, use the following articles to review the most common causes and resolutions for high CPU utilization for that service:

Object Store	ProxySG CPU monitor showing high CPU in Object Store
HTTP and FTP	ProxySG CPU monitor showing high CPU in HTTP
Miscellaneous	ProxySG CPU monitor showing high CPU in Miscellaneous
TCP/IP	ProxySG CPU monitor showing high CPU in TCP/IP
Policy evaluation - HTTP	ProxySG CPU monitor showing high CPU in Policy
SSL and Cryptography	High CPU in SSL and Cryptography showing ProxySG and Advanced Secure Gateway
LSA	ProxySG CPU monitor showing high CPU in LSA

Known Issues Causing High CPU

• Traffic 
•  Lack of available resources to process data 
•  Complex configuration or policy
•  Bug in the code

If the above articles did not help resolve the high CPU utilization issue, these articles also document defects or configurations that can cause this issue:

Issue Type	Fixed Release	Article
Defect	SGOS 6.5.7.6	CPU monitor showing high CPU in Policy on ProxySG running SGOS 6.5 after installing a policy
Configuration	N/A	Why is CPU utilization of policy evaluation in SGOS 6.5 much greater than in 6.2?
Configuration	N/A	ProxySG Experiencing High CPU Utilization and Input Errors on TCP Interface
Configuration	N/A	ProxySG Event Log reports "TCP in Livelock" during periods of high CPU utilization

If you are still unable to resolve the high CPU utilization issue, you will need to open a ticket with Symantec Support. In addition to the details from the CPU Monitor, you may also be asked to provide the following:

1. SysInfo_stats Snapshots
   • Configure snapshots to happen every five minutes (default is 60), and run for at least 20 minutes during the CPU spike.
   • For detailed instructions on creating the snapshots, please refer to: How do I create low interval snapshot stats on the ProxySG?
2. SysInfo
   • The SysInfo information should be captured after the CPU utilization has returned to normal, or after 20 minutes of high utilization for a persistent utilization spike.
   • This information can be uploaded through the management console Maintenance tab or captured using the url:
   • https://>:8082/Sysinfo 
3. Event Log
   • The Event Log should be captured after the CPU utilization has returned to normal or after 20 minutes of high utilization for a persistent utilization spike.
   • This information can be uploaded through the management console Maintenance tab or captured using the url: 
   • https://>:8082/Eventlog/Statistics
4. TCP Users
   • While the CPU utilization is high, copy the output from the following url:
   • https://<proxy_ip>/TCP/Users
5. Full Core (Optional)
   • Depending on the nature and symptoms of the high utilization issue, you may be asked to provide a full core dump of the ProxySG.
   • For instructions on capturing a full core dump, please refer to: How do I force or create a manual memory dump on the ProxySG