This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

UTM 120 CPU spikes

Hi,

I have a number of UTM 120s deployed for different clients. Several of these clients are now complaining that they occasionally lose Internet connectivity for periods of 30 seconds to a minute. VoIP call quality also decreases during this time.

I've verified that every time, I'm seeing CPU spikes to 80-100% on the UTMs.
If I turn off Web Filtering, the problem goes away, but I don't like leaving that off.

I've rebooted the UTMs, updated them, checked settings for anything I can limit, and nothing seems to be working.

Do I have bad UTMs? Is there a recent firmware update that increased resource usage? Are they just overloaded?

I'd appreciate any help. I'm stuck.
Thanks!

This thread was automatically locked due to age.

0 Amodin over 10 years ago

What are the hardware specs of the 120s you are using and what version of UTM?
Cancel
Vote Up 0 Vote Down

Cancel
0 atoast217 over 10 years ago

Sorry for the delay.

The UTM 120 should have a 1.6 Ghz Atom dual core processor.

The UTM versions vary, generally from 9.313-9.315.
Cancel
Vote Up 0 Vote Down

Cancel
0 SimonWiggins over 10 years ago

We're seeing the same, issue. Even on a smaller site with only four devices.

Firmware Version: 9.315002 Model: ASG 120r5
Cancel
Vote Up 0 Vote Down

Cancel
0 SimonWiggins over 10 years ago

Firmware Version: 9.315002 Model: ASG 120r5
Cancel
Vote Up 0 Vote Down

Cancel
0 William Warren over 10 years ago

The 120's are ram starved very badly. Since you are running older hardware in limited ram you have to reduce the load on the machine. Run a/v in single scan...reduce your reporting retention to 3 months or less make ips rule aging 3 months..etc etc etc.

My advice? get new hardware preferably starting with no less than a 115. the sg105 have two gigs of ram which is no beuno in my book. the 115 has 4 gigs of ram. If you have a reseller contact them..if not pm me..[:)]
Cancel
Vote Up 0 Vote Down

Cancel
0 atoast217 over 10 years ago

Actually, I made a mistake. The Atom on the UTM 120 is actually a single core.

We've contacted Sophos support, and they're telling us the same thing.
We've also had luck disabling Web Filtering entirely, but that's not a move that I like doing at all (no AV scanning). They also increased swap file size on the 120s, but it didn't seem to help.

I actually tried setting AV from dual scan to single scan on one device. Somehow, the spikes were more frequent after this. ???

I wanted to confirm that we were on the right track. Thanks for all your answers!
Cancel
Vote Up 0 Vote Down

Cancel
0 William Warren over 10 years ago

Increasing swap isn't going to do anything. New hardware is the only thing that is going to solve this on a reliable basis.
Cancel
Vote Up 0 Vote Down

Cancel
0 teched_01 over 10 years ago

Have you used atop, and/or other tools, to help analyze resource utilization?

See KB120835 and KB121222
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 10 years ago

With 9.3, I've had to make adjustments at the command line for some clients to schedule anti-virus updates around their busy times. Reduced Intrusion Prevention rules, etc.

Also, see Sascha Paris' suggestions: https://community.sophos.com/products/unified-threat-management/astaroorg/f/51/t/22429

These are stop-gap measures while you and your reseller work out a deal with Sophos to get you into a new machine. We're nearing the end of the time I disagree with William about 2GB vs. 4 for the smallest installations.

Cheers - Bob
Cancel
Vote Up 0 Vote Down

Cancel
0 Aulendil over 10 years ago

To be honest, you should replace the UTM120 devices with a SG135. The currents firmware is not running very well on the old UTMs if you have RAM consuming features enabled.
Cancel
Vote Up 0 Vote Down

Cancel