Sophos XG 330 - Random High CPU Usage

[CHiLL]

We are experiencing spikes of 100% CPU usage on our Sophos XG 330 at certain points of the day. It usually happens around 2pm, but not limited to that. We cannot see what is causing the high CPU, as none of the other diagnosit charts are spiking (like throughput charts would if it was an ICMP DDoS attack or something, like we've had/seen in the past). Our supplier is investigating the issue, but it's been ongoing for a while and we have OFSTED in today and tomorrow, which has prompted me to post the issue on here! I've had a DM from a user on here relating to a post I made in another thread, suffered a similar issue and understood it to be a known issue that Sophos are investigating and it might be relating to the time settings needing to be set as UTC rather than GMT. Though they have a UTM device which is not the same product as ours, so it may not be a related issue.

 

If anyone else has the Sophos XG330, have you been experiencing this sort of issue?

[Michael]

I work with a number of XGS2100's and a XG210, running firmware 19.5.2. No issues to report.

 

CPU sits at approx. 5-10% and memory sits at approx. 54%.

 

I presume the high CPU is throttling network/internet connectivity performance?

 

If it's not limited to 14:00 everyday, presumably it also happens out of hours? If you unplug your LAN and plug a single device with a static IP, is the CPU utilisation still high?

[CHiLL]

I work with a number of XGS2100's and a XG210, running firmware 19.5.2. No issues to report.

Thanks for your reply. We are running firmware 19.0.2. The XG displays 19.5 as available and set to automatically upgrade, though it hasn't, so I wonder if updates are being witheld by our supplier via Sophos Central.

 

CPU sits at approx. 5-10% and memory sits at approx. 54%.

 

I presume the high CPU is throttling network/internet connectivity performance?

We're not seeing any other high usage on the device, including Internet activity, so it doesn't appear to be network/Internet related from that respect. The only correlation we are seeing is that when it happens, we have the most amount of users connected at about 250...which should be well within the XG's capability as far as I can tell.

 

If it's not limited to 14:00 everyday, presumably it also happens out of hours? If you unplug your LAN and plug a single device with a static IP, is the CPU utilisation still high?

I'm not willing to test that yet with user's on-site and especially with OFSTED in!

[Michael]

Agreed - wait until Ofsted's out the way, speak to your provider, then I would recommend upgrading which of course also requires a reboot. Firmware 19.0.2 was released in January 2023 (a quick Google) according to Sophos. Firmware 19.5.2 is weeks old comparatively.