Support Support Downloads Knowledge Base Apex Support Portal Community

Knowledge Base

Search our Knowledge Base sites to find answers to your questions.

Ask All Knowledge Base Sites All Knowledge Base Sites JunosE Defect (KA)Knowledge BaseSecurity AdvisoriesTechnical BulletinsTechnotes Sign in to display secure content and recently viewed articles

[ScreenOS] How to trigger the CPU snapshot tool when a high CPU spike occurs by using the alarm threshold



Article ID: KB12143 KB Last Updated: 16 Jul 2015Version: 5.0
To collect information about a high CPU utilization issue, the CPU snapshot tool can be used. This tool can be triggered to make a snapshot in the following methods:

  • Manual triggering by using set alarm snapshot CPU trigger.

  • Automatic triggering by using set alarm threshold cpu <percentage value (1 - 100%)>.

The second option is very useful, when high CPU utilization spikes of a short duration occur.

As described in KB8910 - Determining which task is using the most resources on the CPU, the CPU snapshot tool can be used to obtain information about the cause of high CPU utilization.

This can be done as follows:

set alarm snapshot CPU on
set alarm snapshot CPU trigger (repeat this 2-3 times in 10 second intervals)
unset alarm snapshot CPU on
get alarm snapshot CPU all

This provides good information, if the CPU is still high at the moment that the snapshot is being triggered.

Ifr only occasional spikes in the CPU utilization occcur and the CPU is at a normal level during the rest of the time, then it will be very hard to manually trigger the snapshot at just the right moment. In this case, it will be useful to automatically trigger a CPU snapshot, as soon as a spike occurs (refer to the Solution section).



A CPU snapshot can be automatically triggered, when the CPU utilization exceeds a certain configured threshold. This can be done by using the following commands:

set alarm snapshot CPU on
set alarm threshold cpu <percentage value (1 - 100%)>

Whenever the CPU utilization reaches the configured percentage value (for example 80%), a CPU snapshot will be produced. A complete command sequence will be like this:

set alarm snapshot CPU on
set alarm threshold cpu <percentage value 80
... leave the snapshot enabled untill after a CPU spike occurred ...
get alarm snapshot CPU all

After a spike has actually occurred, the snapshot feature and the alarm threshold can be disabled again:

unset alarm snapshot CPU on
unset alarm threshold cpu

Another useful effect of setting an alarm threshold is that it will also trigger a log entry, when the threshold is exceeded. This way, it can be seen when and how often a high CPU spike occurs

The current alarm threshold value can be checked with the get alarm threshold command. The following example is of the alarm threshold producing a log entry:

firewall-> set alarm threshold cpu 80 
firewall-> get alarm threshold      
Alarm threshold:
    Memory  :  off 95%
    CPU     :  on 80%
    Session :  90%
firewall-> get event
Total event entries = 2578
Date       Time     Module Level  Type Description
2008-08-21 13:03:59 system crit  00030 SYSTEMSystem CPU utilization is high
                                       (85 > alarm threshold:80) 1 times in 1

To clear the previously obtained alarm snapshot logs, use the clear alarm snapshot command.

Related Links

Comment on this article > Affected Products Browse the Knowledge Base for more articles related to these product categories. Select a category to begin.

Getting Up and Running with Junos

Getting Up and Running with Junos Security Alerts and Vulnerabilities Product Alerts and Software Release Notices Problem Report (PR) Search Tool EOL Notices and Bulletins JTAC User Guide Customer Care User Guide Pathfinder SRX High Availability Configurator SRX VPN Configurator Training Courses and Videos End User Licence Agreement Global Search