topic Re: What is "cdt_token" process? in General Topics

What is "cdt_token" process?

epavis — Wed, 05 Jun 2019 13:16:02 GMT

Hi there,

Quick question. I'm currently troubleshooting a PA 3020 in version 8.0.12 for one of my customer. Its PA has huge DP CPU usage (arround 80%). I try to figure out the reason of this usage.

I've isolated the "ctd_token" process which is a big CPU user. Can you give me a hint about its utility?

cheers,

Edouard

Re: What is "cdt_token" process?

MP18 — Thu, 06 Jun 2019 03:40:10 GMT

so how much cpu process is used by this process?

any other process has high cpu usage?

do you have ssl decryption enabled?

Re: What is "cdt_token" process?

epavis — Thu, 13 Jun 2019 07:38:09 GMT

Support explained me the meaning of this process:

"The tokens are for decoder regex matches , so check to see if they have a lot of custom signatures defined via regex. do you using a lot of custom signature? "

=> There is no custom sig.

Then they reply :

"CTD ( content detection) and To reduce the cpu overload used by the content detector, application override need to be configured for the above applications.
you need to double check the acc logs and see the top 3 application used during the high dp load and create the application override for those application."

Re: What is "cdt_token" process?

OtakarKlier — Thu, 13 Jun 2019 15:42:38 GMT

Hello,

While App override does reduce the DP CPU usage, it is because it bypasses Content inspection so the data is identified and 'trusted' and not scanned for malicious payloads.

Use sparingly!

Regards,

Re: What is "cdt_token" process?

MP18 — Thu, 13 Jun 2019 17:49:23 GMT

agree it is not safe to use app override under these scenarios.

Re: What is "cdt_token" process?

MP18 — Thu, 13 Jun 2019 17:51:38 GMT

This is not good idea to use the app override to reduce the DP load

are you hitting the capacity issues on current PA?

upgrading the hardware is safer option i think but it depends on your company also?

are you doing ssl decryption?

what is your max session count?

Re: What is "cdt_token" process?

epavis — Fri, 14 Jun 2019 08:39:39 GMT

Hi, I agree, override will be a temporary solution. We explained the customer he has to upgrade the box (no ssl decryption). The box is just hitting its capabilities. Thanks all and have a good day.