How to tell what's causing CPU spikes?

Probably pattern updates - look in the Up2Date log. the cssd process eats a lot of cycles when Web Filtering patterns are updated.

Cheers - Bob

Thanks, Bob.

I do see the following Up2Date log entries about 30 seconds prior to the spikes:

[INFO-306] New Pattern Up2Dates installed

What's odd to me is the fact that these spikes did not happen until the last update to 9.508-10.

How often do you have it set to update?  I have mine at 6hrs.  Maybe set it at 24 hours and see what happens.

Jay Jay said:

How often do you have it set to update?  I have mine at 6hrs.  Maybe set it at 24 hours and see what happens.

I'll have to check that but I haven't changed any settings. Both are set to the default of 15 minutes.

Again, what's puzzling me is the fact that I started getting the spikes in CPU usage immediately after updating to 9.508-10. I haven't touched any settings. You can see how flat the CPU usage is in the first third of the graph depicted in the image I added to my original post. The first third shows CPU usage with FW version 9.507-1.

My theory is that it's cssd integrating the new patterns into a spread-out database is what causes the spike.  I've thought that it might be interesting to see if they go away after an install from ISO.  Let us know if that solves this for you.

Cheers - Bob

I'll try installing from ISO and let you know.

Thanks, guys!

Bob, you mean spikes caused by disk fragmentation?

Is your idea to perform a back up, install from iso from scratch, then restore the backup?

Exactly, Jay.  Mind you, this is just an educated guess.

Cheers - Bob

I learned something new. I added my backup file to the root of the bootable USB drive that I created to install Sophos from. It seems my backup was automatically imported when I installed Sophos.

Too early to tell if I still get the spikes so I will report back, later.

I have another question... Since I used a thumb drive as my installation media, I had to manually mount it. On my first attempt, I mistakenly specified "sda1" instead of "sdb1" so the installation failed but I received an "IRQ 16 disabled" message on the install screen. Is that because I specified the wrong drive or is that an indication that I have a hardware issue with this PC? I did not get that error on my second install attempt.

Hi Jeff,

I think you should console to UTM (ssh, telnet), log on UTM then check cpu use with command: top

On screen, you can see service are running on system. From that, you know cause CPU spikes.

Hope it can help you