Sophos Firewall

Discussions Sophos XG310 18.0.5 MR-5 CPU spikes

Sophos Firewall requires membership for participation - click to join

Thread Info

State Not Answered
Locked Locked
Replies 5 replies
Subscribers 28 subscribers
Views 600 views
Users 0 members are here

Options

Suggested

This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos XG310 18.0.5 MR-5 CPU spikes

Chris Capio over 4 years ago

We have been experiencing major CPU spikes (see picture) which cause the internet connection for users to drop when the spikes occur.

Troubleshooting steps takes so far :

- lowered live users to stay within 300-500

- offloaded wifi connections/access points to a separate XG310

The below picture was taken as the CPU spike was clearing. It appears that awarrenhttp or snort are always the top talkers during a CPU spike

Has anyone else experienced this issue and if so what did you do to mitigate the situation ?

This thread was automatically locked due to age.

Parents

0 LuCar Toni over 4 years ago

Seems like your appliance is way off sized for your deployment. Did the spikes only occur on MR5 or also on MR4?
Cancel
Vote Up 0 Vote Down

Cancel
0 Chris Capio over 4 years ago in reply to LuCar Toni

LuCar - Thanks for the response.

It also happened on MR4 and Support said to upgrade to MR5.

I just happened across this article : https://community.sophos.com/sophos-xg-firewall/f/discussions/123652/internet-traffic-stops-every-time-xg-has-an-ips-or-atp-update

I wonder if we are experiencing the same issue because of this :

There does seem to be a time correlation based on the "Last Successful Update" under "Update Status"
Cancel
Vote Up 0 Vote Down

Cancel
0 LuCar Toni over 4 years ago in reply to Chris Capio

Then try to disable firewall acceleration. console> system firewall-acceleration disable
Cancel
Vote Up 0 Vote Down

Cancel
0 Chris Capio over 4 years ago in reply to LuCar Toni

I did check that through the console and it is already disabled
Cancel
Vote Up 0 Vote Down

Cancel
0 LuCar Toni over 4 years ago in reply to Chris Capio

Then i would recommend to create a support case but i still believe, your appliance is not able to perform the needed performance for you setup.
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 LuCar Toni over 4 years ago in reply to Chris Capio

Then i would recommend to create a support case but i still believe, your appliance is not able to perform the needed performance for you setup.
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data