What Untangle applications use the most CPU?

[LingaringBell]

So.... someone in my department that shall remain nameless (not me!) bought a server to run vmware server. I set up the untangle virtual appliance and it works fine.... until you send a bunch of traffic through it. The problem is that the CPUs in this server just don't cut it. The average CPU load is around 15. When I monitor CPU usage, system + user = 60-70% on average. So of course when the CPU usage jumps up to around 80 or 90%, users complain of slow internet. There doesn't actually seem to be a "problem" as far as I can tell, the hardware just isn't fast enough. I tried the attack blocker, but users still complain of slow connections because their packets are being limited/blocked. Now I'm trying to decide which applications to turn off to reduce CPU usage. I'm using the standard free bundle. I turned off the ad blocker. I would prefer to keep the web filter (which I'm sure is most of the load), the firewall, and the protocol control running. If I run top on untangle all of the applications are running under a single "java" command so I can't tell individual app cpu usage. Any help or suggestions are much appreciated! Thanks!

P.S. If it matters here is my system info:

Untangle 8.1 32 bit, 4 gigs of RAM, vmware server 2.0.2

[sky-knight]

The three huge CPU hogs are the two AV modules, and the Spam blocker. The other modules don't burn hardly any CPU at all.

[johnsonx42]

you shouldn't be running Untangle on VMWare Server. Put VMWare VSphere Hypervisor on the box first, then Untangle and any other needed VM's.

[LingaringBell]

Why not VMWare Server?

[dmorris]

sky-knight is right, AV and spam are probably the most aggressive with CPU. However, I doubt that is your issue. With a load of 15 you have something wrong.

[LingaringBell]

Any suggestions for where I should look dmorris? I don't see any issues in the syslog. When I'm seeing high load I am also seeing around 900-1000 TCP/UDP sessions. I was thinking the load was appropriate but perhaps not?

[dmorris]

Not sure.
I'd start by putting it on a real server and seeing what happens.

A load of 15 is very bad.

[sky-knight]

900-1000 TCP/UDP sessions?

That is a ton of traffic, and not a load that I've seen outside of some of the larger bare metal installations. You can make that work in a VM Format, but it isn't going to be with the VMWare Server product. You NEED the hypervisor for that... not a server hosted application.

I'd also give serious consideration to simply going bare metal, it will make things easier in many ways.

[LingaringBell]

I agree that bare metal is better. The server that was purchased has a fakeRAID on it that doesn't work with anything but windows. I had to load a linux server and create a software RAID, which I don't think you can do with the hypervisor. Just trying to work with what I've got. Just to make sure I understand what you are saying. You think that the amount of traffic is just too much for a server running on vmware server? Thanks for the input!

[sky-knight]

Well fakeRAID isn't helping much, but the bottom line here is you need more CPU to deal with the load you're injecting.

I also agree with Dirk that you have something else going on... but solving the something else within the VMWare Server framework is going to be very difficult, time consuming, and these forums won't be much help.