This KB provides guidance on resolving a scenario where customers report that the Mist Cloud is pushing unexpected configurations to their device, resulting in high CPU utilization. It offers comprehensive steps to identify, troubleshoot, and mitigate the issue effectively, ensuring stable and optimized device performance.

• The Mist Cloud WAN Edge Insights consistently logs multiple "Reconfigured" events.
• The customer suspects that the high CPU utilization observed on the device is directly related to the configuration pushes initiated by the Mist Cloud.
• The customer has identified configuration changes in various log files, such as the "configuration-log" file, suggesting that unexpected configurations are being applied to the device.

To address the potential high CPU issue on the device, it's advisable to refrain from requesting files like the RSI and /var/log/ files to avoid additional load. Instead, utilize commands such as >show chassis routing-engine, >show system processes extensive and >show security monitoring fpc "#" to gather insights into any potential spikes in CPU usage. In cases where high CPU is not immediately evident, it's essential to monitor for any sporadic spikes or determine if the issue has subsided.

Check the "WAN Edges>"select the WAN Edge device"> WAN Edge Insights" from the Mist UI to verify if the Mist Cloud is recording any high CPU events. If no high CPU events are detected, proceed with further investigation.

Regarding the "Reconfigured" events, these indicate that the SRX re-establishes the TCP connection to the Mist cloud, so this shouldn't cause any impact on your network. Mist isn't pushing any configurations to the device through those events.

To rule out any underlying issues causing high CPU or related concerns, conduct a comprehensive health check on the device. Refer to the [Internal Only] Generic system health check commands for detailed instructions on performing the health check.

For insights into configuration events, examine the following sections and outputs:

• >show system uptime no-forwarding
  • Example:

root@SRX-JTAC> show system uptime no-forwarding

Current time: 2024-04-26 18:41:17 UTC

Time Source: NTP CLOCK

System booted: 2024-04-26 15:06:35 UTC (03:34:42 ago)

Protocols started: 2024-04-26 15:36:26 UTC (03:04:51 ago)

Last configured: 2024-04-19 11:50:54 UTC (1w0d 06:50 ago) by mist >>>>>

 6:41PM up 3:35, 4 users, load averages: 1.28, 1.07, 0.99

• > show system commit
  • Example:

root@SRX-JTAC> show system commit

0 2024-04-19 11:50:54 UTC by mist via netconf

  oc-script

1 2024-04-16 20:25:33 UTC by root via other

  Synchronization with remote Routing Engine

2 2024-04-16 20:20:11 UTC by root via other

3 2024-04-16 18:18:04 UTC by user-1 via cli

4 2024-04-16 16:09:45 UTC by user-2 via cli

5 2024-04-16 15:35:03 UTC by mist via netconf commit confirmed, rollback in 10mins

  version=1713214085

• In this output, we can see some details of the latest changes, such as who made them, where they originated from, and when they were executed.
• Configuration-related logs:
  • Review the logs to identify specific configuration statements being pushed.
• From the Mist Cloud UI: "Organization>Audit Logs"
  • Analyze this section to determine who made the changes, when they occurred, and what modifications were made.
  • You can use the filtering options.
  • 

By correlating this information, you can ascertain whether the Mist Cloud is indeed pushing configurations to the device.

In this specific case, it was discovered that the changes were indeed being pushed by a user from the Mist Cloud.