High CPU usage

bilbus · Dec 27, 2008, 11:10 PM

After upgrading to 1.2.1 (from 1.2) my cpu usage has gone from 5-10% to 30-80%.

I tried "top" and "ps ux"

Neither seemed to add up to the number that was being shown on the gui (system)

Are there any other commands i can use to get a better idea what is using all my cpu power?

Thanks

jos · Jan 3, 2009, 1:16 PM

I have noticed the same thing. I had problems with 1.2 that the network drivers used a lot of cpu but with 1.2.1 it has become much worse. If you press S in top it displays the system processes. Here you can see that the drivers plus interrupts uses over 90%.

CPU states: 9.0% user, 0.7% nice, 31.7% system, 48.9% interrupt, 9.7% idle
Mem: 57M Active, 51M Inact, 138M Wired, 236K Cache, 104M Buf, 683M Free
Swap: 512M Total, 512M Free

PID USERNAME THR PRI NICE SIZE RES STATE TIME WCPU COMMAND
25 root 1 -68 - 0K 8K WAIT 210:12 30.86% irq18: rl0
29 root 1 -68 - 0K 8K WAIT 176:29 20.17% irq16: rl2

wallabybob · Jan 4, 2009, 4:26 AM

Have you tried putting the interfaces in polling mode? (In the web GUI, System menu, Advanced, then check box "Use device polling".) This has been observed to considerably reduce the CPU overhead on some workloads. Polling increases latency a little bit (received packets aren't processed immediately but every poll, and polls happen about 1024 times a second)

jos · Jan 4, 2009, 6:44 AM

Yes, I run in polling mode. The cpu usage is much lower and everything seems to work much better.
Interesting still is why there is so big difference between 1.2 and 1.2.1.

wallabybob · Jan 4, 2009, 7:16 AM

My firewall has 1 x vr NIC, 1 x rl, 1 x ath and 1 x udav, I've been running some variant of pfSense 1.2.1 for some months now and can't recall ever seeing similar interrupt percentages to what you see.

If you are curious to explore this issue further, perhaps you could take the interfaces out of polling mode and give the shell command vmstat -i to see interrupt rates on rl0 and rl2. Are these interfaces in promiscuous mode (possibly bridged with another interface)? Are they connected to a hub rather than a switch? Do you have something "new" happening causing more network traffic?