This article describes about one of the high CPU condition on SRX series of devices due to the KMD process utilizing CPU.

High routing engine CPU observed and upon checking s"how system process extensive | except 0.00" , it shows KMD utilizing more CPU.

 PID USERNAME PRI NICE  SIZE  RES STATE C  TIME  WCPU COMMAND

10158 root   111  0 69820K 37656K RUN  0 49.1H 31.54% kmd



If the KMD process is causing high CPU, one of the main reason could be because of too many VPN phase-1 and phase-2 negotiations happening.

To confirm the same, check the tunnels which are down using the below command:

show security ike security association | match down

The tunnels which are in down state will try negotiate with the ike peer and it will cause overhead to the RE.

To resolve the above mentioned issue, identify the tunnels which are down and try to bring up the tunnel or deactivate the ike and ipsec for the respective tunnels incase of 3rd part issues like ISP/peer-device.

deactivate security ike <ikegateway-name>

deactivate security ipsec vpn <ipsecVPN name>