Understanding KTranslate CPU Usage

Understanding KTranslate CPU Usage

Problem

Your ktranslate containers are hitting 100% CPU utilization, or CPU usage is higher than expected.

Tip: Focus on maximum CPU percentage rather than the average. ktranslate uses a high percentage of CPU near the beginning of a polling cycle and much less toward the end. An average of 60% can mask the fact that the container is spending time at or near 100% — which is a problem. Allocate enough resources so that peak CPU consumption does not reach 100%.

Solution

The causes of high CPU usage vary depending on the type of ktranslate container you are running.

SNMP

SNMP containers see CPU increases primarily due to:

• The number of data points to collect from target devices
• The time spent attempting to collect each data point

Devices with high SNMP response latency require more resources. Longer timeout or more retries values improve data collection reliability but increase resource requirements. A high volume of incoming SNMP trap events also increases CPU load — as a rough estimate, expect to handle approximately 1,000 trap events per second per CPU core.

Options to reduce CPU usage:

• Add more CPU cores to the host.
• Increase polling intervals by raising the poll_time_sec value in global or device-specific config.
• Reduce the number of polled devices by removing them from the devices section and excluding them from automatic rediscovery.
• Remove unneeded MIBs from the mibs_enabled global list.
• Reduce noisy SNMP trap volume by reconfiguring network devices to suppress lower-value traps.

Flow

Flow containers see CPU increases primarily due to the volume of inbound flow events. As a rough estimate, expect to handle approximately 2,000 flows per second per CPU core (load varies slightly by protocol).

Options to reduce CPU usage:

• Add more CPU cores to the host.
• Reduce incoming flow volume by reconfiguring network devices — for example, collecting flows only on critical interfaces or enabling sampled flows.

Syslog

Syslog containers see CPU increases primarily due to the volume of inbound syslog events. As a rough estimate, expect to handle approximately 2,000 messages per second.

Options to reduce CPU usage:

• Add more CPU cores to the host.
• Reduce noisy syslog volume by reconfiguring network devices to suppress low-value message types or severity levels. Consult your device vendor's documentation for how to make these changes.