System stats

[jdprovine]

Is there a way to run a report to see if CPU is getting spiked over a 24 hour period of time

[jvalentine]

This is for CPU specifically, but you can also use to monitor buffer utilization, session table utilization, etc.  

admin@pa0(active)> show running resource-monitor hour last 24

Resource monitoring sampling data (per hour):

CPU load (%) during last 24 hours:
core 0 1
avg max avg max
0 0 2 14
0 0 2 14
0 0 2 18
0 0 2 17
0 0 2 14
0 0 2 15
0 0 2 12
0 0 1 15
0 0 2 14
0 0 2 14
0 0 1 13
0 0 2 95
0 0 1 51
0 0 1 12
0 0 2 20
0 0 2 14
0 0 2 43
0 0 2 13
0 0 2 18
0 0 1 30
0 0 2 99
0 0 2 34
0 0 3 16
0 0 2 15

Resource utilization (%) during last 24 hours:
session (average):
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0 0 0 0 0 0 0 0 0
session (maximum):
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0 0 0 0 0 0 0 0 0
packet buffer (average):
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0 0 0 0 0 0 0 0 0
packet buffer (maximum):
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0 0 0 0 0 0 0 0 0
packet descriptor (average):
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0 0 0 0 0 0 0 0 0
packet descriptor (maximum):
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0 0 0 0 0 0 0 0 0
sw tags descriptor (average):
1 1 1 1 1 1 1 1 1 1 1 1 1 1 1
1 1 1 1 1 1 1 1 1
sw tags descriptor (maximum):
1 1 1 1 1 1 1 1 1 1 1 1 1 1 1
1 1 1 1 1 1 1 1 1

This particular firewall is a VM-Series with 2 vCPU allocated.  In this configuration, core1 does all of the data processing.  Your firewall may have 1, 2, 4, 6, 24, 36, or more (if you have a chassis) cores across 1 or more dataplanes.  

If you look at the output of the first few lines:

core

0       1
avg max avg max
0   0   2   14  <-- core 1 average utilization for the last hour was 2%, but spiked to 14%

0   0   2   14  <-- core 1 avg util 2 hours ago was 2%, spiked to 14%

0   0   2   18  <-- core 1 avg util 3 hours ago was 2%, spiked to 18%

...

...

0   0   2   95  <-- avg 2%, spike to 95% (12 hours ago)

If you want the full output, use "show running resource-monitor" without any modifiers.  This will show you second-by-second for the last 60 seconds (no averages on this one as it is a direct 1-second measurement - the rest include avg/max), minute-by-minute for the last 60 minutes, hour-by-hour for the last 24-hours, day-by-day for the last 7 days, week-by-week for the last 13 weeks.