1.From the output below, we can find the CPU usage was 98%.

> show security monitoring fpc 0
node0:
--------------------------------------------------------------------------
FPC 0
 PIC 0
  CPU utilization     :  98 %

However, upon inspecting the connections per second, it was found to be less than 80k, which is far less than SRX4600 maximum number 570k.

Checked https flow session on the device and found that most of the https traffic goes to some specific server IP and total number of https session was around 600k.

After setting a firewall filter on the incoming interface to block the https traffic to this server, the CPU usage decreased to 18%.

Upon rolling back the config and the CPU usage recovered to 98%.

Based on this, it's suspected the standard IDP rules applied to these connections at this quantity is causing issues. Since IDP is in alert only mode, we should suggest, as a test, that customer remove IDP actions from the policy allowing this particular HTTPS traffic.

Disabled IDP for these rules, results were positive per below:

# show | compare rollback 0 
[edit security policies from-zone <> to-zone <> policy <> then permit]
-    application-services {
-      idp-policy test-policy;
-    }

> show security monitoring fpc 0 
node0:
--------------------------------------------------------------------------
FPC 0
 PIC 0
  CPU utilization     : 33 %
  Memory utilization   : 48 %