CPU load on the management plane (MP) can get quite high and can in turn lead to other issues. With this in mind, it might be necessary to reduce the load on the MP. We'll cover some ways to reduce MP CPU usage.
A common cause of a high MP CPU load is logging and reporting.
By default, every session is logged at the end. Additionally, you can opt to enable logging from the start for better visibility on the morphology of applications traversing the firewall or to simply have more data available for forensic analysis. You may also be required to log the drop-all rule at the end of the policy. These options and more logging actions cause the logrcvr process to consume more resources.
Security Policy Log Setting
To enable the system to produce reports easier, there are several helper processes that come into play to process and prepare the log files for later report generation. These helper processes consume even more resources as more logs must be processed.
When the management plane is experiencing a continuous high load and you need to reduce the load, then you might want to consider reducing logging. Below are a few options for reducing logging.
Some applications may not be critical enough to be logged all the time. For example, DNS tends to be extremely chatty, causing a lot of log files to be generated, which may not be vital to the organization:
NOTE: That threat logs are generated by threat protection, so disabling logging in the security policy only stops generating traffic logs.
Some URL categories may be benign and permissible within the organization, so setting the URL filtering action to allow prevents a URL log from being created each time an allowed category is accessed:
Report generation can also consume considerable resources, while some pre-defined reports may not be useful to the organization, or they've been replaced by a custom report. These pre-defined reports can be disabled from Device > Setup > Logging and Reporting Settings
Logging and Reporting Settings Pre-Defined Reports
There are more ways to reduce the MP load and not all of these will be considered best practice but they might be necessary if the load on your device is too high.
Thanks for taking time to read the blog.
If you enjoyed this, please hit the Like (thumbs up) button, don't forget to subscribe to the LIVEcommunity Blog.
As always, we welcome all comments and feedback in the comments section below.