Loading...
Loading...
An ASA Firewall may exhibit elevated CPU utilization under very low traffic rates. 'show process cpu-usage non-zero' shows most of the CPU usage is in the datapath as shown here: uut19-5512# show processes cpu-usage non-zero PC Thread 5Sec 1Min 5Min Process 0x00000000019649eb 0x00007fffee11d560 0.0% 0.2% 0.3% ssh - - 95.4% 34.9% 38.5% DATAPATH-0-1451 Also, 'cpu hog granular-detection 1000 1' and 'show process cpu-hog' contain output similar to this: Process: DATAPATH-0-1451, PROC_PC_TOTAL: 52, MAXHOG: 9284, LASTHOG: 2584 LASTHOG At: 23:41:21 UTC Apr 6 2015 PC: 0x0000000000000000 (suspend) Process: DATAPATH-0-1451, NUMHOG: 51, MAXHOG: 9284, LASTHOG: 2584 LASTHOG At: 23:41:21 UTC Apr 6 2015 PC: 0x0000000000000000 (suspend) Call stack: 0x00000000004381fa 0x000000000071cc3d 0x000000000171170d 0x000000000171aaac 0x000000371c808201 Interrupt based hog entry #1 Hog #1, traceback #1, at: 23:40:28 UTC Apr 6 2015, hog 9 ms PC: 0x000000371c47a9b4 Call stack: Hog #1, traceback #2, at: 23:40:28 UTC Apr 6 2015, hog 19 ms PC: 0x000000371c47a9b0 Call stack: Note there is no Call stack in the "Interrupt based hog entry", and the PC is in the 0x0000003700000000 range.
Threat-detection is enabled or memory delay-free-poisoner are enabled. This issue affects 9.3.2.x code versions only. 9.3.3 contains the fix for this issue.
Disable threat detection (it is enabled be default). This can be done by issuing the following commands in global configuration: no threat-detection basic-threat no threat-detection statistics Also make sure the delayed-free-poisoner is not enabled (it is not enabled by default and should be enabled only under TAC supervision): no memory delayed-free-poisoner enable
None.
The Cisco PSIRT has evaluated this issue and does not meet the criteria for PSIRT ownership or involvement. This issue will be addressed via normal resolution channels. If you believe that there is new information that would cause a change in the severity of this issue, please contact psirt@cisco.com for another evaluation. Additional information on Cisco''s security vulnerability policy can be found at the following URL: http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html
Click on a version to see all relevant bugs
Cisco Integration
Learn more about where this data comes from
Bug Scrub Advisor
Streamline upgrades with automated vendor bug scrubs
BugZero Enterprise
Wish you caught this bug sooner? Get proactive today.