How do I monitor how much of the IPS cpu is being consumed?

[sjbuckingham]

I have a PA-4060 and am monitoring via a TAP port my Internet connection and want to see how much traffic is being sent to the IPS engine hardware.  I need to know this because I know the IPS functionally is 1/2 of the rated throughput of the firewall functionallity.

I know about the following commands but I don't think this gives me what I want:

show system statistics                  - shows total bandwidth passing through the PAN
show running resource-monitor           - shows data plane CPU usgae at different time intervals
show system resources                   - shows management plane CPU usage

[gsamuels · Accepted solution]

The closest thing to what you are looking is the cli command

'show running  resource-monitor' this will give the cpu utilization per core' , all dataplane traffic is load shared among the cores listed.

Look for the CPU load(%) status.

[sjbuckingham]

Can a command be added to the CLI, WebUI and SNMP so we have the ability to monitor/view it?  On a per vsys level would be the ideal solution.

Thanks,

Scott

[frank_henry]

I run the command and it doesn't look like the load is shared amoungst all the cores  ( PANOS 4.0.3) :

CPU load (%) during last 13 weeks:
core    0       1       2       3  
     avg max avg max avg max avg max
       0   0   1  14   2  81   2  81
       0   0   1  25   2  70   2  70
       0   0   1  38   2 100   2 100
       0   0   1  51   2  78   2  78
       0   0   1  24   2  81   2  81
       0   0   1  23   2  83   2  85
       0   0   1  40   1  80   2  80
       0   0   1  23   2 100   2 100
       0   0   1  44   2  99   2  99
       0   0   1  24   2 100   2 100
       0   0   1  44   2  97   2  97
       0   0   0  10   0  11   0  11
       0   0   0   0   0   0   0   0

Could someone please clarify?  I'd not expect to see MAX of 100 percent if there is a virtually unused core (0, in this case).

thanks

[jleung]

Hi,

We assign different task to different processors. There are some processors reserved for dataplane and mgmt plane communication, some for flow control and handling, some for logging, while all remaining reserved for data processing. So some processors will be very busy while few of them may be more idle, depends on their job duties and loading.

Regards,

Jones