Description

Customers may observe "Arena utilization reaches critical level" warning messages when IDP inline tap mode is enabled on SRX devices.

This article gives the cause for the warning messages to appear and recommends that it is better to not enable IDP inline tap mode.

 

Symptoms

After IDP inline tap mode is enabled on SRX devices, the "Arena utilization reaches critical level!" warning appears in the message log. 

# show configuration security forwarding-process
application-services {
    maximize-idp-sessions {
        inline-tap;
    }
}
 

The following errors are seen on the console and in /var/log/messages* :

Note: The following warning appears only after arena usage crosses arena_warning_level , which by default is set to 90%. 

Message from syslogd@srx3400-1 at Apr 5 09:33:47.930 2017 ...
srx3400-1 Warning: Arena utilization reaches critical level!

Message from syslogd@srx3400-1 at Apr 5 09:33:57.933 2017 ...
srx3400-1 Arena utilization falls back to normal level.
 

When the Command Line Interface output of show arena is observed in vty mode, "global data SHM" usage is shown to be high. 

vty node1.fpc5.pic0
=== SPU5.0, node1.fpc5.pic0 flowd> show arena

ID        Base      Total(b)       Free(b)       Used(b)   %   Name
--  ----------  ------------  ------------  ------------  ---  ----
 0    28f33e00     239075328       2091616     236983712   99  jsf shm arena
 1    28f35350      13631488      13455888        175600    1  global cntl SHM
 2    29c35380     223346688      20095280     203251408   91  global data SHM   <<< usage is high
 3    29c434f0        262144        254976          7168    2  Services control arena
 4    78dae218       2097144       2091704          5440    0  IDP Arena
 5    7a810d08      33554424      18130152      15424272   45  jdpi arena

 

Solution

IDP inline tap mode consumes a lot of memory due to which the above error is observed.

 

It is recommended not to enable IDP inline tap mode because it consumes a lot of memory. However, if the error is seen, the warning message can be resolved by deactivating IDP inline tap mode with the following command: 

deactivate security forwarding-process application-services maximize-idp-sessions inline-tap

Note: Starting from Junos OS Release 15.1X49-D10 and Junos OS 17.3R1, IDP inline tap mode is no longer supported. For more information, see Understanding IDP Inline Tap Mode .

 

Related Information