CTD usage and commit and update errors

[nikoo]

VM-300, 10.0.8-h4 on KVM.

At one point issue with commit showed up:

Error: Error reading signature DFA data
failed to handle CONFIG_UPDATE_START

Also updates for Wildfire & Apps/Threats were not being installed. HA sync started to fail.

It was concluded that CTD resource usage is high - show system setting ctd state, Content Allocator Usage was 100%.

Restarting VM helped, but just for a while, almost instantly usage was back when tried to install dynamic updates and same result - commit failed.

Next step as per discussion found in the Live Community - Data Pattern Object was present on the firewall and it was deleted. Memory usage instantly dropped to 95% and after a while to 88% - commits, HA sync and updates are working as expected.

Tried the same on the lab VM (no configuration, pretty much empty VM) - by creating custom Data Pattern and Spyware object, installing all the updates, etc. I got the usage to 91%, so couldn't really reproduce the 100% usage and didn't get the commit to fail.

Anyway, currently using Data Patter object is not mandatory, but overall - has anyone seen something similar? Is there a solution to use the custom objects while still keeping the memory usage in order?

[S.Cantwell]

Good Day.

Without knowing the pattern of what the customer Data Filtering looks like, what the alert settings looked like, it does appear as if the Data Pattern was too general, hence CPU spike.  I am not aware of any workaround, but it seems like better crafting the Data Filtering profile, pattern, alert numbers would be a start.