Hi All,

I am working on checkpoint firewall which is built on linux platform. I can see high %si value. Can anybody suggest me how to troubleshoot this ?
2014-12-28 17:10:51 top - 17:10:51 up 20 days, 7:42, 0 users, load average: 0.00, 0.01, 0.00
2014-12-28 17:10:51 Tasks: 109 total, 1 running, 108 sleeping, 0 stopped, 0 zombie
2014-12-28 17:10:51 Cpu(s): 8.5%us, 4.7%sy, 0.2%ni, 82.7%id, 0.0%wa, 1.2%hi, 2.7%si, 0.0%st
2014-12-28 17:10:51 Mem: 4056852k total, 4019800k used, 37052k free, 608600k buffers

Regards,
Neo

Hey Neo

The SI value is % of time processing soft interrupts. It's a checkpoint firewall, so the network interfaces are probably queuing connection requests for processing...
are you sure the value is high for a checkpoint firewall?

Some trouble shooting

"mpstat -P ALL"
You'll see several column heads, the two we're most interested in right now are %IRQ and %Soft. Take a look at those numbers, are they similar to what TOP is showing you?

Take a look at /proc/interrupts (cat /proc/interrupts). Which interrupt channels are the likely culprit according to those numbers? (you'll have a big number in loc ~local interrupts~ look for any channel getting hit hard with processor requests.)