How to tell what's causing CPU spikes?

Probably pattern updates - look in the Up2Date log. the cssd process eats a lot of cycles when Web Filtering patterns are updated.

Cheers - Bob

Thanks, Bob.

I do see the following Up2Date log entries about 30 seconds prior to the spikes:

[INFO-306] New Pattern Up2Dates installed

What's odd to me is the fact that these spikes did not happen until the last update to 9.508-10.

How often do you have it set to update?  I have mine at 6hrs.  Maybe set it at 24 hours and see what happens.

Jay Jay said:

How often do you have it set to update?  I have mine at 6hrs.  Maybe set it at 24 hours and see what happens.

I'll have to check that but I haven't changed any settings. Both are set to the default of 15 minutes.

Again, what's puzzling me is the fact that I started getting the spikes in CPU usage immediately after updating to 9.508-10. I haven't touched any settings. You can see how flat the CPU usage is in the first third of the graph depicted in the image I added to my original post. The first third shows CPU usage with FW version 9.507-1.

My theory is that it's cssd integrating the new patterns into a spread-out database is what causes the spike.  I've thought that it might be interesting to see if they go away after an install from ISO.  Let us know if that solves this for you.

Cheers - Bob

I'll try installing from ISO and let you know.

Thanks, guys!

I'll try installing from ISO and let you know.

Thanks, guys!

Bob, you mean spikes caused by disk fragmentation?

Is your idea to perform a back up, install from iso from scratch, then restore the backup?

Exactly, Jay.  Mind you, this is just an educated guess.

Cheers - Bob

I learned something new. I added my backup file to the root of the bootable USB drive that I created to install Sophos from. It seems my backup was automatically imported when I installed Sophos.

Too early to tell if I still get the spikes so I will report back, later.

I have another question... Since I used a thumb drive as my installation media, I had to manually mount it. On my first attempt, I mistakenly specified "sda1" instead of "sdb1" so the installation failed but I received an "IRQ 16 disabled" message on the install screen. Is that because I specified the wrong drive or is that an indication that I have a hardware issue with this PC? I did not get that error on my second install attempt.

Bob, if only my educated guesses were as good as yours ;-)

Below is before and after screen caps of the fresh install:

Before:

After:

Thanks for being the guinea pig, Jeff - we all learned something here!

Cheers - Bob

I'm still on 9.506.  Will probably wait til the end of the month before upgrading.  Will image the utm vm before I do anything.  Backup files are nice, but being able to restore to an exact prior state is even better.  Unless backup separately somehow, I don't believe log files are part of any backup file.