Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 12 replies
  • Subscribers 1 subscriber
  • Views 3461 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

HTTPProx using up CPU

njorge
We're having an issue with our UTM 425 where the httpprox process will start to gobble-up CPU. Normal CPU usage here is about 10-20% during peak hours. But occasionally I'll see it spike up to 40% and stay there indefinitely. When I SSH in and run top, it looks like httpprox is pegging a CPU.

I can then toggle web filtering off/back on via the web gui, or reboot, and the problem goes away until the next day.

Our re-seller doesn't see anything obvious. Where should I begin troubleshooting?


This thread was automatically locked due to age.
Parents Reply Children
  • 0 in reply to William Warren
    how many users?  which features?  what version of UTM software?


    About 700 users.

    Base Functionality, Network Protection, Web Protection.


    • Firewall is active with 19 rules.
    • Web Filtering is active, 91036 requests served today (11:42 AM)
    • Network Visibility is Active, 1 Application Control rule active
    • Remote Access (HTML5 VPN) is active with 0 online users.
    • Sophos UTM Manager is connected.
    • Advanced Threat Protection is active.
    • Antivirus is active for protocols HTTP and HTTPS using the Sophos engine for sizes up to 3 MB.
    • Antispyware is active.



    HTTPS scanning is for URL filtering only.

    Verion 9.305-4.

    I tried turning off "Send suspicious content to SophosLabs for analysis". CPU usage dropped to normal for about an hour, and then spikes again.
  • 0 in reply to njorge
    This is a graph of our CPU usage. It's pretty apparent when httpprox is consuming CPU.
  • 0 in reply to njorge
    This is a graph of our CPU usage. It's pretty apparent when httpprox is consuming CPU.


    ok so it is happening during working hours.  It appears something is going on in the network that is pressing the http proxy.  I'd be happy to take a quick gander during a cpu spike if you'd like.  pm me if interested.  my previous thoughts though still stand.