New Sophos Support Phone Numbers in Effect July 1st, 2023

Thread Info
  • State Suggested Answer
  • Replies 13 replies
  • Answers 1 answer
  • Subscribers 30 subscribers
  • Views 1447 views
  • Users 0 members are here
Options
Suggested

SASI high CPU usage

Patrick Wolfensberger

Hi there!

I'm currently running on SFVH (SFOS 19.5.0 GA-Build197) and notice a very high CPU usage caused by the SASI service. I tried to turn off Anti-Spam in my E-Mail profile, but it didn't change. 

TOP:

Control Center:

The only thing I could find was a periodic error while trying to download some Checksums (?) in the sasi.log:

Any ideas? Did anyone observe anything similar? Maybe even a fix?

Regards,

Patrick



Added TAGs
[edited by: Erick Jan at 9:39 AM (GMT -8) on 2 Mar 2023]
Parents Reply Children
  • 0 in reply to bobbylam

    Hi,

    Patrick's system fails to access SASI DB checksum files on sasi.sophosupd.com. When this happens, the system's CPU starts to spin until reaching a timeout, but then (after 140 seconds) it tries again.

    I've asked Patrick to check whether a firewall rule or another network device blocks that.

  • 0 in reply to JanosRapcsak

    Hi,

    your answer does cause me some concern. A user firewall rule is capable of blocking traffic that is not recorded in any report and would not not show up in the log viewer review of that firewall rule.

    The traffic does not show up in daily WAN usage so how is a user supposed to identify a failure?

    Ian

    XG115W - v19.5.2 mr-2 - Home

    If a post solves your question please use the 'Verify Answer' button.

  • 0 in reply to rfcat_vk

    Hi there

    I replied to Janos yesterday. My Sophos firewall is directly connected to my ISP without any active network device in between. I noticed however that trying to download the SASI DB checksum via terminal (curl command) and force it to use IPv4 (curl -ipv4), it works fine every time. If I force it to use IPv6 (curl -ipv6) it fails most of the time (curl gets stuck and has t obe aborted). Ping and Traceroute to the SASI server however work for both IPv4 and IPv6 directly from the firewall's terminal. 

    Regards, Patrick

Unfiltered HTML