> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cyberup24.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Performance Degradation

Performance degradation on the LARK typically presents as slow analyst tool response times, delayed alert generation, or visible gaps in captured data. In most cases the cause is one of a small number of identifiable conditions, all of which you can assess from the admin interface without any hardware access. This page covers the most common causes and the steps to resolve each one.

## Storage near capacity

The most frequent cause of performance degradation is onboard storage approaching or reaching its capacity limit. When the storage tier becomes highly utilized, write throughput decreases, services begin queuing data rather than writing it immediately, and the system may shed older data faster than expected.

**Signs:** Slow queries in the analytics tools, delayed packet capture writes, storage utilization warnings in the admin UI.

**Resolution:**

1. Open the admin interface and check the current storage utilization level.
2. If utilization is above 80%, initiate a data offload to move data to an external destination. See [Data Offloading](/data-management/data-offloading) for configuration steps.
3. After offloading, confirm utilization has dropped and that all services have returned to a running state.
4. Configure a scheduled offload to prevent the condition from recurring. Review the [Recommended Configuration](/reference/recommended-configuration) guidance for storage offload best practices.

<Tip>
  Configure periodic data offloading before storage reaches 70% utilization. Allowing storage to fill completely can cause service failures, not just slowdowns.
</Tip>

## Resource contention from too many applications

Every application running on the LARK consumes compute and memory from the appliance's fixed resource pool. Running more applications than the model's capacity supports will cause all services to slow down as they compete for resources.

**Signs:** Multiple services slow simultaneously, pod resource warnings visible in system status, AI inference noticeably slower than usual.

**Resolution:**

1. Open the admin interface and review the list of running applications.
2. Identify any applications that are not actively needed and disable them temporarily. See [Application Management](/administration/application-management).
3. Monitor system status after disabling applications to confirm resource pressure has eased.
4. If the issue persists after reducing applications, consider whether the current LARK model (SWIFT, PEREGRINE, or APEX) is appropriately sized for your workload. Contact support if you need guidance on model capacity options.

## High ingress traffic volume

If the traffic being fed to the appliance exceeds the model's processing capacity, the system may begin dropping packets or lagging behind real-time. This is most common on SWIFT units monitoring high-throughput links.

**Signs:** Visible packet loss counters in the capture tools, telemetry gaps in the flow analytics view, increasing queue depth warnings.

**Resolution:**

1. Assess whether the monitored traffic volume is within the expected capacity for your model. The delivery record documents the rated throughput for your unit.
2. If traffic volume is consistently above capacity, consider filtering at the TAP or SPAN source to reduce the ingress rate, or evaluate upgrading to a higher-capacity model.
3. If the high volume is temporary (for example, a network scan or burst event), allow the system to stabilize once the burst subsides.

## Thermal issues from blocked ventilation

The LARK regulates its own temperature by drawing airflow through its vents. If those vents are obstructed — by objects placed against the case, by an enclosed or poorly ventilated space, or by dust accumulation — the system will throttle CPU performance to protect itself from overheating.

**Signs:** System noticeably warm to the touch on the exterior, fan noise significantly louder than normal, performance degrades after the appliance has been running for a period.

**Resolution:**

1. Inspect the appliance's ventilation openings and ensure nothing is blocking them. Maintain at least several centimeters of clearance on all vented sides.
2. Verify the appliance is on a stable, hard surface rather than a soft or fabric surface that might impede airflow.
3. If the operating environment is unusually warm, improve ambient cooling or move the appliance to a cooler location.

<Note>
  If performance issues persist after addressing these conditions, refer to [When to Escalate](/troubleshooting/escalation-criteria) for guidance on contacting support.
</Note>