Performance alert

Hi Jelle,

From what I understand, the system utilisation number is a reference to how much load is currently hitting the appliance across all of its services and daemons. Generally the load number can be kind of referenced against each full number being equivalent to a CPU core. So if you have a load of 4, it is expected you are regularly hitting 4 CPU cores worth of processing.

The performance being amber could be because your load has dramatically increased recently so the amber status is because it is warning of a sudden change. Have you made any config changes recently?

Emile

Hi Emile,

No, the last changes where about some exclusions regarding HTTPS scanning and they were made before the last restart.

From my understanding such a warning like you described should have the possibility to acknowledge it. When will the performance indicator switch back to green?

I currently don't see anything I can do. Even if most people are offline and there is little traffic it still shows up.

Hi Emile,

No, the last changes where about some exclusions regarding HTTPS scanning and they were made before the last restart.

From my understanding such a warning like you described should have the possibility to acknowledge it. When will the performance indicator switch back to green?

I currently don't see anything I can do. Even if most people are offline and there is little traffic it still shows up.

Hi Jelle,

have you had a look at the diagnostics tab -> system graphs?

That shows the system load, then look at top to see which of the applications are running high utilisation.

Ian

Hi Ian,

I don't see somethng regarding applications there?

And the graphs about cpu, memory, disk, users, zones and ports look good. It's only the system util at an average of 3.75 of 5. Whereever that comes from.

Hi Jelle,

i was talking about running top in the system console. Something appears to stuck from that load graph.

Ian

Something seems to be wrong with these worker processes.

Hi Jelle,

now you have found the cause, lets us hope Emile has another look and can provide some assistance.

Ian

Hi Jelle,

Could you take a screenshot of an atop from the CLI for me, (just "atop").

Emile

You could put a atop Logging in the background.

https://community.sophos.com/kb/en-us/121222 

(There is not atop, so you will put the atop logging into the background).

atop -w /tmp/log/atop.log 5 &

https://stackoverflow.com/questions/13338870/what-does-at-the-end-of-a-linux-command-mean

Keep in Mind, this will run "forever" or until the next reboot / takeover. 

Read the atop log and get a overview over your spikes. This atop command will write a snapshot each 5 seconds. 

This Load is the "Linux Load".http://www.brendangregg.com/blog/2017-08-08/linux-load-averages.html