Higher than expected CPU Utilization on C2821

Unanswered Question
Feb 17th, 2010

I am experiencing a higher than expected CPU Utilization on a 2821 router at one of my remote locations.  Can anyone explain what DHCPD Dynamic Up is, if it is necessary and how to shut it off if it can be shut down?

Thanks..

Router#sho proc cpu | exclude 0.00%
CPU utilization for five seconds: 35%/2%; one minute: 35%; five minutes: 35%
PID Runtime(ms)   Invoked      uSecs   5Sec   1Min   5Min TTY Process
  38       50948   1783302         28  0.08%  0.07%  0.08%   0 Per-Second Jobs
  66     2536868   9963641        254  0.16%  0.09%  0.08%   0 IP Input
  91         604   2638259          0  0.08%  0.03%  0.02%   0 CEF process
139     72262761432835246          5 32.09% 32.16% 32.15%   0 DHCPD Dynamic Up
141        1544  55719564          0  0.08%  0.08%  0.08%   0 PPP manager
142        1292  55719889          0  0.08%  0.06%  0.08%   0 PPP Events
151        1764  55710601          0  0.08%  0.06%  0.08%   0 RADIUS
152        2856      2667       1070  0.16%  0.12%  0.04% 322 Virtual Exec

Router#show proc mem | inc DHCP
  72   0      30372        444      28904          0          0 DHCPD Receive
101   0          0          0       7008          0          0 DHCPD Timer
131   0     746484     542856      77808      11340          0 DHCPD Database
139   0      24924          0       7256          0          0 DHCPD Dynamic Up

Router#show proc cpu | include DHCPD
  72         152     16060          9  0.00%  0.02%  0.00%   0 DHCPD Receive
101           0        67          0  0.00%  0.00%  0.00%   0 DHCPD Timer
131         324      4382         73  0.00%  0.00%  0.00%   0 DHCPD Database
139     74759921481245977          5 32.17% 32.10% 32.22%   0 DHCPD Dynamic Up

I have this problem too.
1 vote
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
Giuseppe Larosa Wed, 02/17/2010 - 13:25

Hello P-Blake,

it should be related to DHCP server

are defined DHCP local pools on the router ?

Hope to help

Giuseppe

p-blake Wed, 02/24/2010 - 07:37

Yes, there are 2 local pools that seem to be functioning normally.

The router was re-loaded on 2/18/10 and the DHCP Dynamic process went away until between 0400 and 0500 this morning and now the router is back to a constant 40% cpu.

show proc cpu sort | exc 0.00%
CPU utilization for five seconds: 35%/2%; one minute: 36%; five minutes: 36%
PID Runtime(ms)   Invoked      uSecs   5Sec   1Min   5Min TTY Process
  31    14742948-1292143477          0 32.09% 32.77% 32.85%   0 DHCPD Dynamic Up

  38        4768    563644          8  0.08%  0.07%  0.08%   0 Per-Second Jobs
152         752  17610558          0  0.08%  0.07%  0.08%   0 RADIUS
141        5932  17613065          0  0.08%  0.09%  0.08%   0 PPP manager

  66      510880   1962112        260  0.08%  0.09%  0.08%   0 IP Input

I do not see this process on any of my other routers.

Any suggestions on what this process is doing and how to resolve it?

Thanks..


p-blake Wed, 02/24/2010 - 07:37

Yes, there are 2 local pools that seem to be functioning normally.

The router was re-loaded on 2/18/10 and the DHCP Dynamic process went away until between 0400 and 0500 this morning and now the router is back to a constant 40% cpu.

show proc cpu sort | exc 0.00%
CPU utilization for five seconds: 35%/2%; one minute: 36%; five minutes: 36%
PID Runtime(ms)   Invoked      uSecs   5Sec   1Min   5Min TTY Process
  31    14742948-1292143477          0 32.09% 32.77% 32.85%   0 DHCPD Dynamic Up

  38        4768    563644          8  0.08%  0.07%  0.08%   0 Per-Second Jobs
152         752  17610558          0  0.08%  0.07%  0.08%   0 RADIUS
141        5932  17613065          0  0.08%  0.09%  0.08%   0 PPP manager

  66      510880   1962112        260  0.08%  0.09%  0.08%   0 IP Input

I do not see this process on any of my other routers.

Any suggestions on what this process is doing and how to resolve it?

Thanks..

p-blake Wed, 02/24/2010 - 07:50


#show ver
Cisco IOS Software, 2800 Software (C2800NM-IPBASEK9-M), Version 12.4(17b), RELEASE SOFTWARE (fc2)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2008 by Cisco Systems, Inc.
Compiled Tue 26-Feb-08 01:47 by prod_rel_team

ROM: System Bootstrap, Version 12.4(13r)T, RELEASE SOFTWARE (fc1)

C2821-Vandercook_TMC uptime is 6 days, 13 hours, 2 minutes
System returned to ROM by reload at 21:45:37 EST Wed Feb 17 2010
System restarted at 21:46:20 EST Wed Feb 17 2010
System image file is "flash:c2800nm-ipbasek9-mz.124-17b.bin"


This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
Importers, exporters, distributors and users are responsible for
compliance with U.S. and local country laws. By using this product you
agree to comply with applicable laws and regulations. If you are unable
to comply with U.S. and local laws, return this product immediately.

A summary of U.S. laws governing Cisco cryptographic products may be found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html you require further assistance please contact us by sending email to
[email protected] 2821 (revision 53.50) with 251904K/10240K bytes of memory.
Processor board ID FTX1141A3JS
2 Gigabit Ethernet interfaces
4 Serial interfaces
4 Channelized T1/PRI ports
DRAM configuration is 64 bits wide with parity enabled.
239K bytes of non-volatile configuration memory.
62720K bytes of ATA CompactFlash (Read/Write)

If

Cisco

Configuration register is 0x2102

Paolo Bevilacqua Wed, 02/24/2010 - 07:56

Any chance that you have an infected PC on network? Do you have a switch to monitor a suspicios number of broadcasts or other anomaly ?

p-blake Wed, 02/24/2010 - 08:02

not seeing other degradation.  No unusually high broadcast or other

problems.

What command triggers this process to start?

Paolo Bevilacqua Wed, 02/24/2010 - 08:06

Unlikely that a process goes and sustains without reason.

Recommend you turn some dhcp server debugging to buffer (not console, not terminal) and check for rogue requests coming in.

p-blake Wed, 02/24/2010 - 09:46

Below is a section of the log with DEBUG IP DHCP SERVER EVENTS turned on.  Certainly doesn't look as though the router is overwhelmed with DHCP requests.

Router#sho log
Syslog logging: enabled (1 messages dropped, 1 messages rate-limited,
                0 flushes, 0 overruns, xml disabled, filtering disabled)
    Console logging: level debugging, 6092 messages logged, xml disabled,
                     filtering disabled
    Monitor logging: level debugging, 4659 messages logged, xml disabled,
                     filtering disabled
    Buffer logging: level debugging, 109 messages logged, xml disabled,
                    filtering disabled
    Logging Exception size (4096 bytes)
    Count and timestamp logging messages: disabled
    Trap logging: level informational, 207 message lines logged
        Logging to 10.16.1.16(global) (udp port 514, audit disabled,  link up),
207 message lines logged, xml disabled,
               filtering disabled
        Logging to 10.2.74.200(global) (udp port 514, audit disabled,  link up),
207 message lines logged, xml disabled,
               filtering disabled

Log Buffer (65535 bytes):

Feb 24 12:27:16: %SYS-5-CONFIG_I: Configured from console by blakep on vty0 (10.
112.21.72)
Feb 24 12:28:15.194: DHCPD: checking for expired leases.
Feb 24 12:30:15.197: DHCPD: checking for expired leases.
Feb 24 12:32:15.200: DHCPD: checking for expired leases.
Feb 24 12:34:15.203: DHCPD: checking for expired leases.
Feb 24 12:35:56.342: DHCPD: Sending notification of ASSIGNMENT:
Feb 24 12:35:56.342:  DHCPD: address 172.18.4.73 mask 255.255.255.0
Feb 24 12:35:56.342:   DHCPD: htype 1 chaddr 0016.eab3.86f8
Feb 24 12:35:56.342:   DHCPD: lease time remaining (secs) = 2592000
Feb 24 12:36:15.207: DHCPD: checking for expired leases.
Feb 24 12:37:41.661: DHCPD: writing bindings to ftp-server

Feb 24 12:37:44.185: DHCPD: writing address 172.18.4.73.
Feb 24 12:37:44.185: DHCPD: writing address 172.18.4.74.
Feb 24 12:37:44.185: DHCPD: writing address 172.18.4.80.
Feb 24 12:37:44.185: DHCPD: writing address 172.18.4.81.
Feb 24 12:37:44.185: DHCPD: writing address 172.18.4.83.
Feb 24 12:37:44.185: DHCPD: writing address 172.18.4.87.
Feb 24 12:37:44.185: DHCPD: writing address 172.18.4.88.
Feb 24 12:37:44.401: DHCPD: writing address 172.18.4.89.
Feb 24 12:37:44.401: DHCPD: writing address 172.18.4.90.
Feb 24 12:37:44.401: DHCPD: writing address 172.18.4.95.
Feb 24 12:37:44.401: DHCPD: writing address 172.18.4.98.
Feb 24 12:37:44.405: DHCPD: writing address 172.18.4.100.
Feb 24 12:37:44.405: DHCPD: writing address 172.18.4.101.
Feb 24 12:37:44.405: DHCPD: writing address 172.18.4.102.
Feb 24 12:37:44.405: DHCPD: writing address 172.18.4.103.
Feb 24 12:37:44.405: DHCPD: writing address 172.18.4.104.
Feb 24 12:37:44.405: DHCPD: writing address 172.18.4.105.
Feb 24 12:37:44.405: DHCPD: writing address 172.18.4.106.
Feb 24 12:37:44.405: DHCPD: writing address 172.18.4.108.
Feb 24 12:37:44.405: DHCPD: writing address 172.18.4.110.
Feb 24 12:37:44.405: DHCPD: writing address 172.18.4.111.
Feb 24 12:37:44.405: DHCPD: writing address 172.18.4.113.
Feb 24 12:37:44.405: DHCPD: writing address 172.18.4.114.
Feb 24 12:37:44.405: DHCPD: writing address 172.18.4.115.
Feb 24 12:37:44.413: DHCPD: writing address 172.18.4.116.
Feb 24 12:37:44.413: DHCPD: writing address 172.18.4.118.
Feb 24 12:37:44.413: DHCPD: writing address 172.18.4.121.
Feb 24 12:37:44.413: DHCPD: writing address 172.18.4.123.
Feb 24 12:37:44.413: DHCPD: writing address 172.18.4.129.
Feb 24 12:37:44.413: DHCPD: writing address 172.18.4.130.
Feb 24 12:37:44.413: DHCPD: writing address 172.18.4.131.
Feb 24 12:37:44.413: DHCPD: writing address 172.18.4.132.
Feb 24 12:37:44.413: DHCPD: writing address 172.18.4.137.
Feb 24 12:37:44.413: DHCPD: writing address 172.18.4.163.
Feb 24 12:37:44.417: DHCPD: writing address 172.18.4.181.
Feb 24 12:37:44.417: DHCPD: writing address 172.18.4.185.
Feb 24 12:37:44.417: DHCPD: writing address 172.18.4.192.
Feb 24 12:37:44.417: DHCPD: writing address 172.18.41.68.
Feb 24 12:37:44.417: DHCPD: writing address 172.18.41.70.
Feb 24 12:37:44.417: DHCPD: writing address 172.18.41.71.
Feb 24 12:37:44.417: DHCPD: writing address 172.18.41.73.
Feb 24 12:37:44.417: DHCPD: writing address 172.18.41.77.
Feb 24 12:37:44.417: DHCPD: writing address 172.18.41.80.
Feb 24 12:37:44.417: DHCPD: writing address 172.18.41.81.
Feb 24 12:37:44.417: DHCPD: writing address 172.18.41.84.
Feb 24 12:37:44.417: DHCPD: writing address 172.18.41.86.
Feb 24 12:37:44.417: DHCPD: writing address 172.18.41.87.
Feb 24 12:37:44.417: DHCPD: writing address 172.18.41.88.
Feb 24 12:37:44.417: DHCPD: writing address 172.18.41.89.
Feb 24 12:37:44.421: DHCPD: writing address 172.18.41.90.
Feb 24 12:37:44.421: DHCPD: writing address 172.18.41.92.
Feb 24 12:37:44.421: DHCPD: writing address 172.18.41.93.
Feb 24 12:37:44.421: DHCPD: writing address 172.18.41.94.
Feb 24 12:37:44.421: DHCPD: writing address 172.18.41.95.
Feb 24 12:37:44.421: DHCPD: writing address 172.18.41.96.
Feb 24 12:37:44.421: DHCPD: writing address 172.18.41.98.
Feb 24 12:37:44.421: DHCPD: writing address 172.18.41.100.
Feb 24 12:37:44.421: DHCPD: writing address 172.18.41.101.
Feb 24 12:37:44.425: DHCPD: writing address 172.18.41.103.
Feb 24 12:37:44.425: DHCPD: writing address 172.18.41.104.
Feb 24 12:37:44.425: DHCPD: writing address 172.18.41.105.
Feb 24 12:37:44.425: DHCPD: writing address 172.18.41.106.
Feb 24 12:37:44.425: DHCPD: writing address 172.18.41.107.
Feb 24 12:37:44.425: DHCPD: writing address 172.18.41.108.
Feb 24 12:37:44.425: DHCPD: writing address 172.18.41.109.
Feb 24 12:37:44.425: DHCPD: writing address 172.18.41.110.
Feb 24 12:37:44.425: DHCPD: writing address 172.18.41.111.
Feb 24 12:37:44.425: DHCPD: writing address 172.18.41.112.
Feb 24 12:37:44.425: DHCPD: writing address 172.18.41.113.
Feb 24 12:37:44.425: DHCPD: writing address 172.18.41.114.
Feb 24 12:37:44.425: DHCPD: writing address 172.18.41.115.
Feb 24 12:37:44.425: DHCPD: writing address 172.18.41.116.
Feb 24 12:37:44.425: DHCPD: writing address 172.18.41.117.
Feb 24 12:37:44.425: DHCPD: writing address 172.18.41.118.
Feb 24 12:37:44.429: DHCPD: writing address 172.18.41.119.
Feb 24 12:37:44.429: DHCPD: writing address 172.18.41.120.
Feb 24 12:37:44.429: DHCPD: writing address 172.18.41.121.
Feb 24 12:37:44.429: DHCPD: writing address 172.18.41.122.
Feb 24 12:37:44.429: DHCPD: writing address 172.18.41.123.
Feb 24 12:37:44.429: DHCPD: writing address 172.18.41.124.
Feb 24 12:37:44.429: DHCPD: writing address 172.18.41.125.
Feb 24 12:37:44.429: DHCPD: writing address 172.18.41.126.
Feb 24 12:37:44.429: DHCPD: writing address 172.18.41.127.
Feb 24 12:37:44.429: DHCPD: writing address 172.18.41.128.
Feb 24 12:37:44.429: DHCPD: writing address 172.18.41.129.
Feb 24 12:37:44.429: DHCPD: writing address 172.18.41.130.
Feb 24 12:37:44.433: DHCPD: writing address 172.18.41.131.
Feb 24 12:37:44.433: DHCPD: writing address 172.18.41.132.
Feb 24 12:37:44.433: DHCPD: writing address 172.18.41.133.
Feb 24 12:37:44.433: DHCPD: writing address 172.18.41.134.
Feb 24 12:37:44.433: DHCPD: writing address 172.18.41.135.
Feb 24 12:37:44.433: DHCPD: writing address 172.18.41.136.
Feb 24 12:37:44.433: DHCPD: writing address 172.18.41.137.
Feb 24 12:37:44.433: DHCPD: writing address 172.18.41.138.
Feb 24 12:37:44.453: DHCPD: wrote automatic bindings to ftpserver.
Feb 24 12:38:15.210: DHCPD: checking for expired leases.
Feb 24 12:40:15.213: DHCPD: checking for expired leases.
Feb 24 12:42:15.216: DHCPD: checking for expired leases.
Router#

Paolo Bevilacqua Wed, 02/24/2010 - 09:55

Feb 24 12:37:41.661: DHCPD: writing bindings to ftp-server


So you haven't any config like ftp ?

p-blake Wed, 02/24/2010 - 09:58

not sure what you are asking.  I sanitized the output just to indicate that the in

formation was transfered to the FTP server.

Paolo Bevilacqua Wed, 02/24/2010 - 10:08

I do not see any config of your. What I'm saying, if router is trying to save DHCP status, some config must be telling it to do so.

Actions

This Discussion

Related Content