'SH PROC CPU'

[jkeeffe]

In the above show command on a 6509 MSFC, what does the IP SNMP field indicate? The proc cpu is running at 70% and this field is consistantly in the 40-55% range. Is this indicating that the router is processing massive amounts of SNMP traffic destined to the router? Or is this indicating the router is routing massive amounts of SNMP packets through its interfaces?

[Prashanth Krishnappa · Accepted solution]

The following page should get you started

http://www.cisco.com/warp/public/477/SNMP/ipsnmphighcpu.shtml

[glen.grant]

You definetly have someone doing some heavy duty snmp traffic coming to the box , you need to track this down . In order for them to do anything it must be someone who knows your snmp read/write strings in order to be able to do anything . Do you have a network monitoring tool somewhere that you use ? i would look there and make sure they are doing cpu intensive stuff like pulling the arp table or something like that . Never seen a msfc run anywhere near that , that's impressive ! :-)

[jkeeffe]

Yes we have a Network Management station monitoring our network. which is what is causing this. I noticed that the CPU is back to around 10% now - the high utilization lasted about an hour. In the document that the other engineer responded with, "SNMP causes High CPU Utilization" there is a 'Recommendation 2' which states to 'enable CEF - so that the SNMP agent responds to a get-next/get-bulk operation for the routing or ARP tables with info from the Forwarding INformation Base (FIB).' CEF was and is enabled on this route so can I assume that the high IP SNMP utilization is not because of walking the ARP/routing table? Is there a way I can insure the CEF FIB is being used for the SNMP operations?