This article describes troubleshooting methodology for investigating high Routing Engine CPU utilization.

During the issue, User and kernel will utilize most of the CPU, as shown below:

Routing Engine status:
Temperature 54 degrees C / 129 degrees F
CPU temperature 76 degrees C / 168 degrees F
Total memory 4096 MB Max 1311 MB used ( 32 percent)
Control plane memory 2320 MB Max 835 MB used ( 36 percent)
Data plane memory 1776 MB Max 462 MB used ( 26 percent)
5 sec CPU utilization:
User 66 percent
Background 0 percent
Kernel 34 percent
Interrupt 0 percent
Idle 0 percent
Model RE-SRX320-POE
Start time 2024-09-05 13:39:13 IST
Uptime 1 hour, 33 minutes, 29 seconds
Last reboot reason 0x200:normal shutdown
Load averages: 1 minute 5 minute 15 minute
2.21 2.08 2.22

1. Investigation revealed that the high Routing Engine CPU utilization was caused by repeated SSH connection attempts originating from external sources. The attempts were made using multiple source IP addresses and various username combinations, resulting in excessive processing on the Routing Engine.
2. To mitigate the issue, a firewall filter was applied to the loopback interface to restrict unauthorized SSH access to the device. After implementing the filter, the volume of unwanted SSH traffic reaching the Routing Engine was significantly reduced, and the RE CPU utilization returned to normal operating levels.