This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

SG210 with Firmware: 9.411-3 most of the time at 90%+ CPU usage

Hello,
Since yesterday our Firewall is at 90%+ CPU usage. We already stopped the Services which generate the most but the Firewall is still at 90%+. Usually it was around 50-70% and worked without Problems. We didnt install anything new but the Problem suddenly appeared. Does annyone have any Idea why this Problem could still be there and knows of a way to fix it ?

This thread was automatically locked due to age.

0 apijnappels over 8 years ago

I cannot say why this is happening, but have you already tried restarting the UTM to see if this makes a difference?

Sometimes it's just the easiest method to simply restart it.
Cancel
Vote Up 0 Vote Down

Cancel
0 mod2402 over 8 years ago

Hi IT BSS,

you said "Usually it was around 50-70%". Are you sure that the appliance is right sized. How many users use the utm and which features are active?

regards

mod
Cancel
Vote Up 0 Vote Down

Cancel
0 soportetecnico over 8 years ago

I have presented problems similar to those reported with a sg 210 the load the equipment has is IPS WAF web filtering are about 100 users
Cancel
Vote Up 0 Vote Down

Cancel
0 mod2402 over 8 years ago in reply to soportetecnico

Hi soportetecnico,

SG 210 for 100 users with networkprotection, waf and web filtering in use is to small. Wrong sizing!#

See attached sizing guide.

https://utmshop.nl/media/utmshop/datasheets/sophos-sg-series-sizing-guide.pdf

regards

mod
Cancel
Vote Up 0 Vote Down

Cancel
0 soportetecnico over 8 years ago in reply to mod2402

According to I understand sg210 it supports 50 users because so few if in the part of specifications are quite high

As I base to size then because I find very low the number of users supported
Cancel
Vote Up 0 Vote Down

Cancel
0 giomoda over 8 years ago in reply to soportetecnico

Web protection and IPS (part of network protection) are the most resource consuming processes on the UTM. WAF, depending on your profiles, number of requests served and hosts protected can also severely impact sizing. That's why although SG210 has a massive throughput, when using those features the number of users supported are greatly reduced.

If you were using only firewall, sure, SG210 would suffice. But, for your scenario, you should consider an SG310 for some room to grow or, at the very least, an SG230.

Regards - Giovani
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 8 years ago in reply to giomoda

I have to side with Giovani's view on this. If this is still the first 30 days, get Sophos to take it back and sell a 230 at least.

An experienced UTM installer might be able to help if you're stuck with that device.

Cheers - Bob
Cancel
Vote Up 0 Vote Down

Cancel