CPU 91%

[russell-r]

all - what would cause my IP input to be so HIGH ::see below:::

CPU utilizati for five seconds: 91%/41%; one minute: 71%; five minutes: 47%

PID Runtime(ms) Invoked uSecs 5Sec 1Min 5Min TTY Process

1 562560 12193215 46 0.00% 0.00% 0.00% 0 Load Meter

2 13746384 27505654 499 0.08% 0.01% 0.00% 0 OSPF Hello

3 199667900 2467348 80924 5.14% 0.63% 0.43% 0 Check heaps

4 180 134 1343 0.00% 0.00% 0.00% 0 Pool Manager

5 4 2 2000 0 .00% 0.00% 0.00% 0 Timers

6 21258728 10928390 1945 0.08% 0.05% 0.05% 0 ARP Input

7 0 1 0 0.00% 0.00% 0.00% 0 SERIAL A'detect

8 122045072 39243620 3109 43.53% 35.28% 22.56% 0 IP Input

[MickPhelps]

Check your config and look for:

no ip route-cache

If you see it, enable it by typing:

ip route-cache

This is what turns "fast switching" off and on. IP Input is what is being process switched.

If you already have fast switching enabled, check for things like policy routing or interfaces that route packets back to the same network segment.

Mick.

[russell-r]

mick,

fast switching is enabled on both interfaces and has the "ip route-cache same interface" command as well.

any other thoughts?

[MickPhelps]

Without more detailed info about your router, its hard to say. Its obvious that your router is having to process alot of IP traffic (as opposed to fast switching it through). Are you running:

NAT

IPSEC

Policy Routing

How many PPS is this router pushing? Is it being overused under normal conditions? Is it an edge router that is under a DOS attack? Do you have someone running port scans through it and extended access-lists on interfaces?

Feel free to contact me directly if you want to run through some ideas but don't wish to post config info on a public forum.

Mick.

[rmushtaq]

Have a look at: http://www.cisco.com/warp/public/63/highcpu.html

[ruwhite]

91/41.... 91-41 = 50, so about 50% of your time is interrupt, and about 41% of your time is processor. It's hard to know if these numbers are right, or wrong, with no history/etc., but if you feel they are too high, then do this:

-- take a look at show proc cpu and see if you can figure out which process is taking up a lot of time. Then try to figure out what that process is doing (is it legitimate). Check the top two or three processes.

-- take a look at the amount of traffic this box is switching. High traffic numbers will cause you to have high interrupt context cpu util. If the traffic level feels low, then check show align for alignment errors and spurious accesses.

Come to RST-321 at networkers--I have an entire section on figuring out high cpu issues.

:-)

Russ

[bhedlund]

RST-321 is still one of my favorite classes at Networkers!

I take it every year. I HIGHLY RECOMMEND IT.

Its a great refesher course.

Brad