How to Monitor SSH or HTTPS Activity on Juniper SRX 240 Firewall

There might be some helpful information for you at the Juniper Knowledge Center.

If RPD is consuming high CPU, then perform the following checks and verify the following parameters:

• Check the interfaces: Check if any interfaces are flapping on the router. This can be verified by looking at the output of the show log messages and show interfaces ge-x/y/z extensive commands. Troubleshoot why they are flapping; if possible you can consider enabling the hold-time for link up and link down.

• Check if there are syslog error messages related to interfaces or any FPC/PIC, by looking at the output of show log messages.

• Check the routes: Verify the total number of routes that are learned by the router by looking at the output of show route summary. Check if it has reached the maximum limit.

• Check the RPD tasks: Identify what is keeping the process busy. This can be checked by first enabling set task accounting on. Important: This itself might increase the load on CPU and its utilization; so do not forget to turn it off when you are done with the required output collection. Then run show task accounting and look for the thread with the high CPU time:

  user@router> show task accounting
  Task                       Started    User Time  System Time  Longest Run
  Scheduler                   146051        1.085        0.090        0.000
  Memory                           1        0.000            0        0.000  <omit>
  BGP.128.0.0.4+179              268       13.975        0.087        0.328
  BGP.0.0.0.0+179      18375163 1w5d 23:16:57.823    48:52.877        0.142
  BGP RT Background              134        8.826        0.023        0.099
  

Find out why a thread, which is related to a particular prefix or a protocol, is taking high CPU.

• You can also verify if routes are oscillating (or route churns) by looking at the output of the shell command: %rtsockmon –t

• Check RPD Memory. Some times High memory utilization might indirectly lead to high CPU.

Your config is possibly safe (if you care about them you should consider rancid or make manual backups) as it's on a different partition.

If you place the install image on a FAT32 formatted USB key you can reinstall JunOS from there, however you may need to use the reformat option which will wipe any config.

Juniper doc: http://www.trapezenetworks.com/techpubs/en_US/junos12.2/topics/task/installation/security-junos-os-boot-loader-usb-storage-device-srx-series-device-installing.html