Load

Phil
Phil
in Firebox - Hardware

I am experiencing some spikes in the load and this is causing slowdowns and other erratic behavior. When I look at the Front Panel in FSM, I can see the Load bar highlighted up to the 1st red bar indicating 80 or 90% utilization. My question is, how do I figure out what is causing this? I look at the status report and it is showing only 30% or so CPU. I know it is probably IDS or antivirus scanning something but how do you spot check?

Comments

  • Phil
    Phil
    edited May 2020

    Running Version 12.5.3.B616762
    Watchguard M470

  • Bruce_Briggs
    Bruce_Briggs

    You can see the CPU utilization of the individual components in WSM Firebox System Manager -> Status Report -> Process list

  • Phil
    Phil

    @Bruce_Briggs said:
    You can see the CPU utilization of the individual components in WSM Firebox System Manager -> Status Report -> Process list

    I looked at that, but adding up the %'s doesn't seem to equate to the high load being shown on the front panel. Is there any way to see it in a log? Sometimes I will get a report from someone complaining, but when i get a chance to look at FSM things go back to normal. Also, is there a list of what each component being shown in the process list as it relates to the subscription services used?

  • Bruce_Briggs
    Bruce_Briggs

    From the docs - describing the Load bar:
    "The CPU utilization value from the device is the average percentage over the last minute."
    So it is difficult to relate the load bar to processes

  • Phil
    Phil

    So how can you pinpoint what processes could have become overloaded? I am trying to determine what policy could be having an adverse affect on load either by being too intrusive or too aggressive in scanning. I did find that my IDS was set to full scan instead of Fast (must have been extra paranoid that day). I made the change back to Fast (default) a few weeks ago and figured that fixed the issue, but today I had reports of slowing down and just caught the load bar in the red when I started to investigate.

  • Bruce_Briggs
    Bruce_Briggs

    Are you using the Access Portal?

    If so, look at this:
    Process guac-standalone
    https://community.watchguard.com/watchguard-community/discussion/comment/3640

    Otherwise to get help in figuring this out, consider opening a support incident.

  • Phil
    Phil

    Thanks for that link, I read through all the posts but it doesn't seem to apply to my situation. I don't have a firecluster, not using access portal (ATM, but plan to), and I do use a NAT rule to allow RDP sessions direct to an RDP server. I do see the reference to new firmware and have seen the new release, guess I should start there. One question, is it common practice to set a reboot on the firewalls? I know way back when I had a 2500, it would need a semi-regular kick from time to time.
    Thanks for your input Bruce!

  • Bruce_Briggs
    Bruce_Briggs

    From posts over the years, it seems that some sites do a weekly reboot.
    No idea how many do or don't.
    In the past, specific XTM versions have had memory leaks, and reboot would help for those versions.
    I don't schedule a reboot, but I don't have a heavily used firewall.

  • Phil
    Phil

    Just a quick update on this...
    I did update the firmware to latest version and of course did a reboot.
    All has been well since the update/reboot.

Categories