10-15-2009 05:10 AM
I was using LMS 3.2, Ciscoview to open a view on a 6500 that has 2 WS-SUP720-3B supervisors and is running s72033-adventerprisek9_wan-mz.122-33.SXH4.bin.
The device was taking a bit to open up, so I clicked it a couple more times and a couple of minutes later it finally opened.
At the same time I had a telnet session to the device and noted thru sh proc cpu sorted that the SNMP ENGINE had spiked to 95% utilization.
Could Ciscoview be the cause of this? I have found through testing that multiple clicks can cause a small cpu jump (6% - 12%) but I haven't yet reproduced the 95% utilization I saw that day.
Is there an initial discovery that Ciscoview first does to gather it's information that's more intensive than subsquent polling?
-Dave
10-15-2009 08:12 AM
Yes, it's certainly possible. Currently, the best way to troubleshoot high CPU in SNMP ENGINE is to get the output of show stack PID for SNMP ENGINE when the spike is occurring. If done at the right time, the stack trace should reveal what object is being polled, and then one can apply a view to restrict access to that object.
10-16-2009 02:55 PM
Thanks. Are there any known objects that would cause this (specific to the hardware/software I mentioned before)?
-Dave
10-16-2009 03:00 PM
Perhaps the CISCO-FLASH-MIB.
10-19-2009 05:15 AM
A couple more questions. Does Ciscoview perform snmpwalks or snmpgets on the device when it is the first time it's contacting it? In the trace logs, I noted:
2009/10/16 22:07:42 EDT TRACE CvDevice: Orig Device Info:
id=192.168.255.21, ipAddr=/192.168.255.21
2009/10/16 22:07:42 EDT TRACE CvDevice: New Device Info:
id=192.168.255.21, ipAddr=192.168.255.21
2009/10/16 22:07:42 EDT TRACE CvDevice: Opening device
192.168.255.21_
...
polling interval=60...
2009/10/16 22:07:42 EDT TRACE Vector: Getting existing CT....
2009/10/16 22:07:42 EDT TRACE Vector: Index of matched CT is -1
2009/10/16 22:07:42 EDT TRACE Vector: Containment tree not found in the
cache
2009/10/16 22:07:42 EDT TRACE Util: Request: ReqId=47, Cmd=Get,
Session=192.168.255.21Session,
I've noted in attempts to open a device the first time, it takes awhile to open which I'm assuming is the snmpwalk/gets being performed on the device to update its cache. When is this cache cleared? On server reboot?
10-19-2009 06:11 AM
CiscoView uses SNMP Gets and Get-Next queries. Depending on the device, it may even use Getbulk.
You are correct in that CiscoView caches data so that subsequent loads of the same device are quicker. The cache is purged when Daemon Manager is restarted, or when CiscoView detects the device has reloaded (by looking at sysUpTime).
10-28-2009 01:32 PM
Is there a list of which trees that CiscoView performs SNMP Gets upon?
10-28-2009 01:35 PM
No. Each device is different, and there aren't even any lists of MIB branches polled on a per-device basis.
11-08-2009 11:09 PM
Based on the stace trace, how do I determine what object is being polled???
router#sh stacks 411
Process 411: SNMP ENGINE
Stack segment 0x522D3C6C - 0x522D6B4C
FP: 0x522D6A60, RA: 0x4129E0F0
FP: 0x522D6AA0, RA: 0x410A45DC
FP: 0x522D6B10, RA: 0x41259454
FP: 0x522D6B28, RA: 0x41259440
Thanks.
Andy
11-09-2009 08:11 AM
Please start a new thread for your issue.
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: