Overview
Check Sensor load, Center resources, synchronization backlog, WAN replay load, and feature-related load when performance degrades.
Use this task to isolate common causes of Cyber Vision performance degradation.
Performance degradation can originate at the Sensor, Center, Global Center, storage layer, or WAN path. Check the highest-risk areas first.
Procedure
| 1. | Check Sensor packet rate and packet drops. |
|
| 2. | Check Center CPU, RAM, storage usage, and write IOPS. |
|
| 3. | Check synchronization backlog. |
|
| 4. | Check WAN utilization during replay. |
|
| 5. | Check mirrored traffic scope. |
|
| 6. | Check Snort or Center DPI load if either feature is enabled. |
|
| 7. | Check for FIPS compatibility mismatches if the deployment uses FIPS packages. |
The likely root cause is identified from Sensor oversubscription, storage latency, Center DPI load, unscoped Snort traffic, WAN congestion during recovery, or FIPS package mismatch.