Introduction
This document describes the reason CPU utilization may be higher after upgrading to AsyncOS 9.7.x on the Cisco Email Security Appliance (ESA).
Prerequisites
Requirements
There are no specific requirements for this document.
Components Used
This document is not restricted to specific software and hardware versions.
The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, make sure that you understand the potential impact of any command.
High CPU utilization after upgrading ESA to AsyncOS 9.7.x
After upgrading to AsyncOS 9.7.x, you may find that overall CPU utilization is significantly higher than previous versions of AsyncOS. This is due to a change in how this number is calculated in AsyncOS 9.7 and above.
CPU Usage by Function
In all versions of AsyncOS, some of the individual subsystems on the appliance have CPU usage reporting categories, for example Anti-Spam, Anti-Virus and Reporting. These categories can be seen in the status detail Command-Line Interface (CLI) command, or in the CPU by Function section of the System Capacity report.
For each of these categories, CPU usage is computed using these method:
- The CPU utilization of each process in the category is recorded for each CPU core in the machine
- For each process, the percentage utilization for the CPU core that is most active for that process is used. All other CPU usage by the process is not used in the result
- The sum of all CPU usage numbers found in step 2 is used to provide the CPU usage for the category
It is important to note that not all processes running on the ESA are included in one of these categories. For example, URL Filtering, Graymail, AMP and attachment processing are not included in any category. Additionally, kernel level functions of the operating system are not included in these categories.
What Changed?
Pre AsyncOS 9.7:
Prior to AsyncOS 9.7, the sum total of all categories was used for the overall CPU usage. This resulted in CPU usage numbers that did not necessarily reflect the real overall CPU usage of the appliance. It did not account for all processes and did not account for all CPU cores.
AsyncOS 9.7 and above:
In AsyncOS 9.7 and higher, overall CPU usage is computed based on the CPU load reported by the operating system's kernel. This accounts for all processes and kernel functions which uses CPU, so the reported CPU usage is typically higher than previous versions of AsyncOS.
Note: This change in behavior was documented in the Release Notes for AsyncOS 9.7, Changes in Behavior section. Please see the Representation of the CPU utilization item in this table.
CPU Load vs. CPU Utilization
Previous versions of AsyncOS used the CPU utilization of processes when computing the overall CPU usage. However, AsyncOS 9.7 and above uses CPU load, which is not quite the same metric.
CPU load specifically refers to the number of process (on average over a given time frame) that were in queue for CPU access or in the which currently accesses the CPU. To arrive at a percentage number from this metric, divide the number of CPU cores in the appliance and multiply by 100.
Typically CPU load is most useful as a metric when the load exceeds the number of CPU cores. Such a state indicates that some processes had to wait in line for access to the CPU. Our reporting system limits this metric to 100%, so any overburdened ESA appears to be constantly using 100% CPU load. This means that high CPU load should only be a cause for concern if the CPU load remains at 100% constantly for an extended period of time.
Feedback