MWG 8.2.12 CPU 100%

[Wagner1991]

Hi All,

I've got the problem with high CPU  usage on MWG version 8.2.12.we currently have two physical appliances, I have restarted the appliances but this high CPU still continues.

I need a suggestion to help me solve this problem.

Regards.

[mkutrieba]

Hello @Wagner1991,

this could literally be anything causing it. You would need to check current running connections with command:
# /opt/mwg/bin/mwg-core -S Connections
and also scans:
# /opt/mwg/bin/mwg-core -S Amjobs

Could be possible that clients generated some huge traffic running multiple updates and MWG initiates an external connection for each and downloads archives, executables etc. and must extract and scan all of them.
Could also be something else, a bug (8.2.12 is from Sep 2020) etc.
The output of the lists maybe provides you more details, maybe you see a pattern like same URL is scanned X times or you see that there are many connections to same website downloading same file.

I would suggest to create a feedback file and also core file while the issue is occurring (to have most important information from MWG while being in high CPU state) and open a ticket with this data as it is to sensitive for sharing in community.

If you do not want to troubleshoot this, I personally would upgrade to latest version and then perform a clean reboot. Update/reboot kills all running connections and scans. If issue is resolved then, we do not know why, if issue re-occurs then any traffic initiated by your clients is causing it and above debug data is needed for support so that they can check why is currently running on MWG and scanned while data was created during high CPU issue time.

FEEDBACK FILE
1) Navigate to "Troubleshooting" > select the MWG you are testing on > "Feedback"
2) Keep the option "Pause running McAfee Web Gateway to create a backtrace (recommended)" enabled (this will NOT stop any service!)
3) Click the "Create Feedback File" button. This way we get your policy, configuration and debug information.
Via CLI:
# /opt/mwg/bin/feedback.sh -l 2

Manual Core File from CLI
1) Navigate to /opt partition to have more disk space available
# cd /opt/mwg/log/debug/cores
2) Manually force a crash to create a gcore file:
# gcore $(pgrep -n mwg-core)
3) Download the file from UI via "Troubleshooting" > "Log files" > "debug" > "cores" or transfer the file via FileZilla or WinSCP

Please let me know if you have further questions.

[Kishore_CYber]

Hello

Will there any service interruption if we perform above mentioned captures during production hours

regards

Kishore