This article explains why eventd is causing high RE CPU utilisation on SRX.

When security logging is configured on SRX in event-stream mode, it can be CPU intensive, as the device has to process the logs in both RE and PFE. Device might end up with 0% idle RE CPU and eventd process will be the one utilising most of the CPU, as shown below:

User@srx> show chassis routing-engine no-forwarding

Routing Engine status:

Temperature    36 degrees C / 96 degrees F
CPU temperature   36 degrees C / 96 degrees F
Total memory    1898 MB Max 380 MB used ( 20 percent)
Memory utilization   20 percent
5 sec CPU utilization:
User      93 percent
Background    0 percent
Kernel     7 percent
Interrupt     1 percent
Idle      0 percent

User@srx> show system processes extensive no-forwarding
last pid: 26842; load averages: 0.90, 0.88, 0.78 up 25+14:13:54  10:20:42

427 threads: 2 running, 365 sleeping, 1 zombie, 59 waiting

CPU: 62.6% user, 0.0% nice, 6.1% system, 1.0% interrupt, 30.2% idle

Mem: 60M Active, 1356M Inact, 1532K Laundry, 285M Wired, 52M Buf, 167M Free

Swap: 1638M Total, 1638M Free

PID USERNAME  PRI NICE SIZE  RES STATE  TIME  WCPU COMMAND

  11 root    155 ki31  0B  16K RUN  185.6H 37.35% idle

26611 root    26  0  97M  26M select 0:01 4.20% cli

13315 root    22  0 743M  31M select 395.7H  3.66% eventd

This is one of the conditions which can over utilise the RE CPU of the device. Eventd process is responsible for all the logging and reporting on SRX and will surely overburden the RE CPU if the excessive logging is configured on the device. Security logging is recommended to be configured in stream mode in order to offload some of the load to PFE. If the security logging is configured in event-stream mode, SRX will have to process the logs in both RE and PFE which would increase the RE CPU load and might end up in a situation with 0% idle RE CPU, putting everything in risk.

Event-stream mode should be used only after evaluating the device limitation, logging requirements and the risk of CPU overload. If the security logging is configured in event-stream mode and the RE CPU is running on the risk of crashing, change the mode to stream, as shown below:

User@srx# set security log mode stream