This article explains why the event message

might appear in the syslog.

When CPU utilization passes a threshold, the system will log a syslog message similar to the following:

The event message

can appear in the syslog due to excessive load or an internal software error.

Perform these steps to determine the cause and resolve the problem (if any):

1.Collect the show command output to help determine the cause of this message.

Capture the output to a file (in case you have to open a technical support case). To do this, configure each SSH client/terminal emulator to log your session.

2.Analyze the show command output:

  • Look for any related events that occurred at or just before the
    message. Such events would be a link flap, route convergence, or similiar.
    Note: If the CPU spike is seen a couple of times a day, it can be ignored. Make sure that the CPU utilization is not continuously high and that the spike occurs infrequently.
  • Pay special attention to any changes that take place both in the configuration of the SRX and in traffic patterns from neighbors to the SRX. An example would be adding a peer or rerouting traffic. For example, if you suddenly start getting a flood of traffic from a neighbor and it is configured with ‘alarm-without-drop’ under screen options, this may result in high CPU utilization. Note that in this scenario, removing the ‘alarm-without-drop’ option might not resolve traffic congestion, but will ease the burden on the CPU.
  • High flow-sampling rates can also lead to high CPU utilization. If you are experiencing high CPU utilization, it is recommended to disable as much sampling as your business rules allow. It is not feasible to list every possible configuration scenario that might cause the high CPU rates, but carefully tracking any network changes should help you and your technical support representative identify possible solutions.
  • If a configuration or external network change does not seem to explain the CPU rates, then an internal software error might be causing the issue. Use the show system core-dumps command to see if any core dumps have occurred in conjunction with the CPU warnings. If so, the core dump(s) should be uploaded to Juniper. Instructions for doing this are in the Related Links below.
  • If the message occurs for only a short period of time in the log messages, it can be ignored (temporary CPU utilization spikes are common and expected).

3.If these efforts do not resolve the problem, contact your technical support representative to investigate the issue further.

About the author


Leave a Comment