Can Ciscoview cause high cpu spikes?

david.fernandes · ‎10-15-2009

I was using LMS 3.2, Ciscoview to open a view on a 6500 that has 2 WS-SUP720-3B supervisors and is running s72033-adventerprisek9_wan-mz.122-33.SXH4.bin.

The device was taking a bit to open up, so I clicked it a couple more times and a couple of minutes later it finally opened.

At the same time I had a telnet session to the device and noted thru sh proc cpu sorted that the SNMP ENGINE had spiked to 95% utilization.

Could Ciscoview be the cause of this? I have found through testing that multiple clicks can cause a small cpu jump (6% - 12%) but I haven't yet reproduced the 95% utilization I saw that day.

Is there an initial discovery that Ciscoview first does to gather it's information that's more intensive than subsquent polling?

-Dave

Joe Clarke · ‎10-15-2009

Yes, it's certainly possible. Currently, the best way to troubleshoot high CPU in SNMP ENGINE is to get the output of show stack PID for SNMP ENGINE when the spike is occurring. If done at the right time, the stack trace should reveal what object is being polled, and then one can apply a view to restrict access to that object.

david.fernandes · ‎10-16-2009

Thanks. Are there any known objects that would cause this (specific to the hardware/software I mentioned before)?

-Dave

Joe Clarke · ‎10-16-2009

Perhaps the CISCO-FLASH-MIB.

david.fernandes · ‎10-19-2009

A couple more questions. Does Ciscoview perform snmpwalks or snmpgets on the device when it is the first time it's contacting it? In the trace logs, I noted:

2009/10/16 22:07:42 EDT TRACE CvDevice: Orig Device Info:

id=192.168.255.21, ipAddr=/192.168.255.21

2009/10/16 22:07:42 EDT TRACE CvDevice: New Device Info:

id=192.168.255.21, ipAddr=192.168.255.21

2009/10/16 22:07:42 EDT TRACE CvDevice: Opening device

192.168.255.21_

...

polling interval=60...

2009/10/16 22:07:42 EDT TRACE Vector: Getting existing CT....

2009/10/16 22:07:42 EDT TRACE Vector: Index of matched CT is -1

2009/10/16 22:07:42 EDT TRACE Vector: Containment tree not found in the

cache

2009/10/16 22:07:42 EDT TRACE Util: Request: ReqId=47, Cmd=Get,

Session=192.168.255.21Session,

I've noted in attempts to open a device the first time, it takes awhile to open which I'm assuming is the snmpwalk/gets being performed on the device to update its cache. When is this cache cleared? On server reboot?

Joe Clarke · ‎10-19-2009

CiscoView uses SNMP Gets and Get-Next queries. Depending on the device, it may even use Getbulk.

You are correct in that CiscoView caches data so that subsequent loads of the same device are quicker. The cache is purged when Daemon Manager is restarted, or when CiscoView detects the device has reloaded (by looking at sysUpTime).

david.fernandes · ‎10-28-2009

Is there a list of which trees that CiscoView performs SNMP Gets upon?

Joe Clarke · ‎10-28-2009

No. Each device is different, and there aren't even any lists of MIB branches polled on a per-device basis.

asaykao73 · ‎11-08-2009

Based on the stace trace, how do I determine what object is being polled???

router#sh stacks 411

Process 411: SNMP ENGINE

Stack segment 0x522D3C6C - 0x522D6B4C

FP: 0x522D6A60, RA: 0x4129E0F0

FP: 0x522D6AA0, RA: 0x410A45DC

FP: 0x522D6B10, RA: 0x41259454

FP: 0x522D6B28, RA: 0x41259440

Thanks.

Andy

Joe Clarke · ‎11-09-2009

Please start a new thread for your issue.