What is "cdt_token" process?

[epavis]

Hi there,

Quick question. I'm currently troubleshooting a PA 3020 in version 8.0.12 for one of my customer. Its PA has huge DP CPU usage (arround 80%). I try to figure out the reason of this usage.

I've isolated the "ctd_token" process which is a big CPU user. Can you give me a hint about its utility?

cheers,

Edouard

[MP18]

so how much cpu process is used by this process?

any other process has high cpu usage?

do you have ssl decryption enabled?

[epavis]

Support explained me the meaning of this process:

"The tokens are for decoder regex matches , so check to see if they have a lot of custom signatures defined via regex. do you using a lot of custom signature? "

=> There is no custom sig.

Then they reply :

"CTD ( content detection) and To reduce the cpu overload used by the content detector, application override need to be configured for the above applications.
you need to double check the acc logs and see the top 3 application used during the high dp load and create the application override for those application."

[OtakarKlier]

Hello,

While App override does reduce the DP CPU usage, it is because it bypasses Content inspection so the data is identified and 'trusted' and not scanned for malicious payloads.

Use sparingly!

Regards,

[MP18]

agree it is not safe to use app override under these scenarios.

[MP18]

This is not good idea to use the app override to reduce the DP load

are you hitting the capacity issues on current PA?

upgrading the hardware is safer option i think but it depends on your company also?

are you doing ssl decryption?

what is your max session count?

[epavis]

Hi, I agree, override will be a temporary solution. We explained the customer he has to upgrade the box (no ssl decryption). The box is just hitting its capabilities. Thanks all and have a good day.