01-29-2003 01:18 AM - edited 03-02-2019 04:37 AM
Hi,
I am facing a typical problem in my 4006 chasis the os is 5.5 , the cpu utilisation is more than 70% thoughout the day, I am attaching output of show process cpu for reference, can someone please suggest me what could be the problem.
Thanks
Salim
CPU utilization for five seconds: 95.50%
one minute: 94.16%
five minutes: 93.05%
PID Runtime(ms) Invoked uSecs 5Sec 1Min 5Min TTY Process
--- ----------- ---------- -------- ------- ------- ------- --- ---------------
1 1426621 0 0 4.50% 5.84% 6.95% -2 Kernel and Idle
2 6 125 1000 0.00% 0.00% 0.00% -2 Flash MIB Updat
3 179780 32278 2740000 3.39% 3.00% 3.00% -2 SynConfig
4 4077 3346 2000 0.06% 0.00% 0.00% -2 Statuspoll
5 65 1038 1000 0.41% 0.00% 0.00% -2 StatusPoll 5s
6 40604 4450 120000 20.08% 18.20% 20.98% 0 show_command
7 4 2 4000 0.00% 0.00% 0.00% -2 SecurityRx
8 19 216 1000 0.00% 0.00% 0.00% -2 SWPoll64bCnt
9 265 4685 2000 0.00% 0.00% 0.00% -2 Earl
10 35 509 1000 0.00% 0.00% 0.00% -2 ProtocolFilter
11 0 1 0 0.00% 0.00% 0.00% -2 telnetd
12 0 1 0 0.00% 0.00% 0.00% -2 llcSSTPFlood
13 357 432 10000 0.41% 0.00% 0.00% -2 cdpd
14 39667 5214 58000 0.24% 0.00% 0.00% -2 cdpdtimer
15 4942 5983 10000 0.47% 0.00% 0.00% -2 SptTimer
16 73486 7670 38000 1.14% 1.92% 1.98% -2 SptBpduRx
17 16107 4857 30000 0.00% 0.00% 0.00% -2 SptBpduTx
18 13463 35852 61000 0.54% 0.00% 0.00% -2 ProtocolTimer
19 0 1 0 0.00% 0.00% 0.00% -2 RMON AlarmTimer
20 395 4681 1000 0.41% 0.00% 0.00% -2 VtpTimer
21 3 39 1000 0.00% 0.00% 0.00% -2 VtpRx
22 21660 4519 50000 0.26% 0.00% 0.00% -2 DTP_Rx
23 117389 2809 91000 0.00% 0.00% 0.00% -2 EthChnlRx
24 9694 1124 26000 0.00% 0.00% 0.00% -2 EthChnlConfig
25 2585 38442 1000 0.23% 0.00% 0.00% -2 sptHelper
26 0 1 0 0.00% 0.00% 0.00% -2 sptTraps
27 30 524 1000 0.00% 0.00% 0.00% -2 ciscoRmonTimer
28 31 524 1000 0.00% 0.00% 0.00% -2 ciscoUsrHistory
29 332 4549 1000 0.00% 0.00% 0.00% -2 pinggateA
31 130 432 1000 0.00% 0.00% 0.00% -2 SysLogTask
84 69030 912639 58000 0.06% 0.00% 0.00% 0 Console
85 108 1 108000 0.00% 0.00% 0.00% -2 snmpdm
01-29-2003 02:31 AM
Hi
Was this before or after the Security Notice - SQL Worm.
Please check the below and see if it explains why you are having high cpu.
Thanks
Title: Cisco Security Notice: MS SQL Worm Mitigation Recommendations
URL: http://www.cisco.com/warp/customer/707/cisco-sn-20030125-worm.shtml
(available to registered users)
http://www.cisco.com/warp/public/707/cisco-sn-20030125-worm.shtml
(available to non-registered users)
Posted: January 25, 2003
Summary: Cisco customers are currently experiencing attacks
due to a new worm that has hit the Internet. The signature
of this worm appears to be high volumes of UDP traffic to port
1434. Affected customers have been experiencing high volumes
of traffic from both internal and external systems.
Symptoms on Cisco devices include, but are not limited to high
CPU and traffic drops on the input interfaces.
01-29-2003 02:49 AM
This is from last couple of days around a 15 days, I did a port scan on the lan and found that udp port 1433 or 1434 is not used on the lan.
What else can be reasons for this to happen?
Best Regards
Salim
01-29-2003 03:04 AM
Do you see Xmit-Err counter increment on unconnected ports? I suggest that you upgrade to latest 5.5(x) which is 5.5(18) and see if you still have the issue. Also the following page should help
01-29-2003 03:38 AM
There is no increment in xmit-err on unconnected ports, also i have gone through the document, I found that there are more number or xmit broadcast's, multicast's and unicast's. but this is not being reflected in process cpu, will the broadcast's effect the cpu utilisation? if yes what are the ways by which broadcasts, multicasts and unicasts can be reduced?
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: