Field Notice: FN74005 - Identity Services Engine: Java Heap Size May Significantly Impact System Performance - Software Upgrade Recommended

Available Languages

Updated:May 26, 2023

Document ID:FN74005

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Notice

THIS FIELD NOTICE IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTY OF MERCHANTABILITY. YOUR USE OF THE INFORMATION ON THE FIELD NOTICE OR MATERIALS LINKED FROM THE FIELD NOTICE IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS FIELD NOTICE AT ANY TIME.

Products Affected

Affected Software Product	Affected Release	Affected Release Number	Comments
Identity Services Engine System Software	2	2.7.0 p2, 2.7.0 p3, 2.7.0 p4, 2.7.0 p5, 2.7.0 p6, 2.7.0 p7
Identity Services Engine System Software	3	3.0.0, 3.0.0 p1, 3.0.0 p2, 3.0.0 p3, 3.0.0 p4, 3.0.0 p5, 3.0.0 p6, 3.1.0, 3.1.0 p1, 3.1.0 p2, 3.1.0 p3, 3.1.0 p4, 3.2.0

Defect Information

Defect ID	Headline
CSCwd45843	Auth Step latency for policy evaluation due to Garbage Collection activity.
CSCwc74531	ise hourly cron should cleanup the cached buffers instead of the 95% memory usage

Problem Description

Affected Cisco Identity Services Engine (ISE) releases may have system performance issues such as high memory utilization, high CPU utilization, high latency, and high load average.

Background

Starting with Cisco ISE Release 2.7 Patch 2, the minimum and initial size of the memory allocation for Java has decreased. This may cause a significant amount of CPU resource consumption.

Problem Symptom

RADIUS Live Logs in the ISE application may display the following behaviors:

Logs that indicate latency are represented by the ⏰icon and reference step latency as shown in the following example:
The RADIUS packet is already in the process.

The issue exists if both symptoms 1 and 2 appear in Live Logs.

To access RADIUS Live Logs, choose Operations > RADIUS > Live Logs and click the 🔍 icon.

In addition, the following alarms may be observed in the Alarms dashlet on the main ISE dashboard:

High Authentication Latency
High Memory Utilization
High Load Average
Profiler Queue Size Limit Reached

Workaround/Solution

Workaround

Reloading the system may temporarily alleviate the issue, but the issue may reappear within minutes after reloading.

Solution

Cisco recommends upgrading to one of the following Cisco ISE releases if system performance issues are observed:

2.7 Patch 9 or later
3.0 Patch 7 or later
3.1 Patch 5 or later
3.2 Patch 1 or later

As an alternate solution, a Hot Patch to fix the issue for all versions of software is available for download from the Cisco Software Download Center.

Revision History

Version	Description	Section	Date
1.1	Updated the Background and Workaround/Solution section.	Background and Workaround/Solution	2023-MAY-26
1.0	Initial Release	—	2023-MAY-02

For More Information

If you require further assistance, or if you have any further questions regarding this field notice, please contact the Cisco Systems Technical Assistance Center (TAC) by one of the following methods:

Open a service request on Cisco.com
By email or telephone

Receive Email Notification For New Field Notices

My Notifications—Set up a profile to receive email updates about reliability, safety, network security, and end-of-sale issues for the Cisco products you specify.