N5K/N7K - Question about CPU monitoring

Unanswered Question


I have a question regarding N5K/N7K devices CPU monitoring:

Let's say I see CPU spikes in "show proc cpu hist" command.

Is there any way I can verify what process caused the CPU spikes?

I know that I can see that using "show proc cpu" or "show process cpu sort", but that is not for the moment when I execute the command.

I'd like to know if I can verify the CPU utilization each process used in the past (let's say, 2 hours ago or 6 hours ago).

Thanking in advance, Udi Dahan.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
krun_shah Tue, 06/05/2012 - 05:43
User Badges:
  • Bronze, 100 points or more

Regarding answer to your question

"Is there any way I can verify what process caused the CPU spikes?"

You can achive this using EEM. You need to write and applet that poll correct OID from Cisco-PROCESS-MIB, if utilization is higher than certain value eg, 70% than action cli would be to collect

"show process cpu" and save it in bootflash i.e. show processes cpu sort >> bootflash:high_cpu.txt

event manager applet High_CPU

event snmp oid get-type next entry-op ge entry-val 70 poll-interval 2

action 1.0 cli "show clock >> bootflash:high_cpu.txt"

action 2.0 cli "show processes cpu sort >> bootflash:high_cpu.txt"

Oleksandr Nesterov Sun, 06/17/2012 - 00:38
User Badges:
  • Cisco Employee,
  • Events Top Contributors,

    Cisco, 2014

Hi Ehud

Observed spikes can be displayed by two signs on sh proc cpu history": asterisk "*" of number sign (#)

Asterisk peaks means peak load which can last evel less than a  second - but if it happens it will be shown int 60 sec diagram, and  other diagrams, such peaks hard to troubleshoot as they're very short  and even EEM not always can catch them. Also most of such spikes are  caused by nx-os components running on the box: snmp, tacacs etc are snmp  intensive processes and can cause such spikes.

Spikes displayed  with number sign (#) reflect average load - and are more relevant to  load on the box, they can be captured by EEM.

As Kruh said EEM is  most convenient way to capture such spikes, but please remember that  only n7k platform support EEM at the moment.




This Discussion