xgs 4300 performance

Hello Walid,

As Ian recommended above, kindly share results of top command:  Sophos Firewall: Understanding “top” and “atop” command in Sophos Firewall/UTM 

Also, could you share more details about when this issue occurred? Was there any previous change on the network or config or any firmware upgrade before bumping into this issue? Could you also share your current SFOS version?

You also mentioned "internet speed decreasing" means there still internet access but just slow, was all users affected by this or only isolated cases? 

Hi Raphael Alganes

I came back to you with your questions.

The SFOS version is  XGS4300 (SFOS 20.0.2 MR-2-Build378)

--Was there any previous change on the network or config or any firmware upgrade before bumping into this issue?

ans: We didn't upgrade the Firmware for along time.

--You also mentioned "internet speed decreasing" means there still internet access but just slow, was all users affected by this or only isolated cases? 

yes the internet becomes slower and all users affected by this

To solve this issue we rebooting the device

I turned off the IPS   for time been

Thanks for your feedback

Hi Raphael Alganes

I came back to you with your questions.

The SFOS version is  XGS4300 (SFOS 20.0.2 MR-2-Build378)

--Was there any previous change on the network or config or any firmware upgrade before bumping into this issue?

ans: We didn't upgrade the Firmware for along time.

--You also mentioned "internet speed decreasing" means there still internet access but just slow, was all users affected by this or only isolated cases? 

yes the internet becomes slower and all users affected by this

To solve this issue we rebooting the device

I turned off the IPS   for time been

Thanks for your feedback

atop results

Hello Walid, 

Thanks for sharing the details. It seems high CPU usage is caused by awarrenhttp in which I suspect IPS (Snort) affects this when scanning/discarding traffic (2nd on the  list - top result)

As Ian also asked above, are you able to see if there's any unusually large volume of dropped traffic on this section when your IPS is turned on?

Also, could you give this KBA a try and optimize your IPS settings to avoid high CPU usage: https://support.sophos.com/support/s/article/KBA-000004083?language=en_US

If the issue would still persist after following the steps above, kindly open a support case then kindly share with us the generated caseID

Thank you for your time and patience and thank you for choosing Sophos.

Regards,