Smoothwall high CPU load

[localzuk]

I am trying to resolve an issue with our Smoothwall VM where it regularly increases its CPU usage to high levels and sends me an alert email.

 

One thing that concerns me is that we have too many web filter rules - so my question to you all is how many rules do you have and do you have any load issues? We have 35 Web filter policies set up, and to me that seems like too many.

[ibpalle]

What is the load value? The load average is an amalgation of disk, cpu and memory activity so not just cpu usage.

 

Is it just because you are getting warnings that you think load is high? The alert, by default, triggers at a value of 1, which is silly - a default we havent changed in the install image but we usually change it during the install. In reports - alerts - alert settings, find the load average alert - if it's still set to one, set it to a reasonable value. On a 4 core system, set it to 4 - on anything higher than that, set it to 8.

[localzuk]

So, the last alerts we received were:

 

1F140500: Warning: System load average is 8.82 4.38 3.46

1F085300: Warning: System load average is 6.01 4.17 3.35

1F111500: Warning: System load average is 11.18 6.41 4.82

1F085400: Warning: System load average is 6.28 4.46 3.54

 

The system was heavily overspecced until recently (32 virtual CPUs, 128GB RAM). Now reduced to much more realistic 16 Virtual cores, 24GB RAM.

[ibpalle]

The load is often generated by disk access and if this is a VM disk is often slow.

 

Is this a parent for a cluster? Is it a firewall and is has a lot of logging options been enabled?

 

On the console. if you run the command top, you can see the distribution of load. The third line from the top looks like this:

 

%Cpu(s): 0.7 us, 0.1 sy, 0.0 ni, 97.9 id, 1.0 wa, 0.0 hi, 0.3 si, 0.0 st

 

What's the value for wa? Thjose are wait states which indicates disk is having to do a lot of work.

[localzuk]

Current top (though load is quite low at the moment):

 

[ibpalle]

Yes, that looks good, it's not constant, which is normal as well. At house cleaning time, log rotation or early morning hours when everyone fires up their PCs. And the values shown in the alert are not excessive at all. Set the alert setting I mentioned before to 8.

[localzuk]

Thanks. Done that. We'll see how it goes now.

[bknaggs]

We have 35 Web filter policies set up, and to me that seems like too many.

 

It probably is but don't worry as I've got (a lot) more than that with an ongoing project to try and tidy things up.

[tom_newton]

Firewall rules tend to add to load, but web filtering not as much