High CPU load on router 2621XM IOS version 12.3

[terrencepayet]

Hello Everyone,Am kind of new to the cisco world.I've just finished setup 6 vlans. All inter vlan routing is done by a router which have 6 subinterfaces, as we have no layer 3 switch. Anyway after the VLAn implementation users are complaining that they are loosing connections to servers and other network services. After further investigations form my side ive noticed that the routers CPU fluctuating 50%, 60% and sometimes 100%.
I've run the sh proc cpu command but found nil process with high load.But it shows that the router is using a lot of CPU (Find attached txt file)Grateful if you guys can help.Thanks.

[Brandon Lynch]

Hey Terrence,

Looking at your CPU output, we see that most of the CPU utilization is occurring under interrupt -

CPU utilization for five seconds: 100%/98%; one minute: 99%; five minutes: 98%

In the five second count, we see a CPU reading in the form of X%/Y%.  The first number, X, is the total CPU utilization while the second number is how much of that is under interrupt.  The difference between X and Y is how much you will see at process level.  Your observation is correct in that we won't see any process with high CPU because this is all under interrupt.

Interrupt-based CPU is generally the combination of two things: features configured and/or traffic through the box.  When a packet comes into an interface of a router, we throw an interrupt to tell the CPU that we have a packet waiting in the Rx ring to be serviced.  Once the CPU receives this interrupt and is able to service the routine, we then go 'under interrupt' to clean out the Rx ring.  Within this same interrupt routine, we must do a couple of things -

1) Perform a CEF look-up to see if the packet is in the CEF table and if so, route it accordingly.

2) Allow any features configured on the interface which the packet came in on to inspect the packet to see if they must perform any actions on it.

For that reason, interrupt-level CPU can go high because of increased traffic rates alone or increased traffic in conjunction with feature processing on this traffic.  Generally speaking, this type of CPU is expected given your traffic rates.  If the traffic rates fluctuate, you may also observe that your CPU drops or bottoms out with lower traffic rates and increases when the traffic rates are at a peak.  'show process cpu history' may give you a better idea of this and you can also do the following -

1) Change the load-interval on the interface(s) to 30 seconds to give a better reading/idea of the input traffic rates -

Router(config-if)# load-interval 30

2) Collect the following output during both a high and low CPU interval -

show proc cpu sorted | ex 0.0

show int | in input rate

You'll likely observe higher total input rates combined through the interfaces with the CPU peaking at 100%.  When the CPU goes high, is it sustained or does it spike only temporarily for a short period of a time?  'show proc cpu history' will show this.

Hope this helps.

Brandon