High CPU utilization on 6500. L3Aging shows 94 % utilization.

[andf1]

Sorry I am posting this into LAN Switching as I should have in the beginning.

Hello all,

We are seeing high CPU utilization on one of our Cisco 6500 layer 3 switches. The logs don't point to any issues. The traffic on the switch is not significant. SHO PROC CPU shows that L3Aging is responsible for 93% of the CPU load. I am opening a TAC case on this issue but I was wondering if anyone knows what the L3Aging process is responsible for.

The switch has dual supervisors with MSFC2s. It is running CAT OS cat6000-sup.6-1-1b.bin. The MSFC2 is running c6msfc2-is-mz_121-3a.E7.

switch-> (enable) sh proc cpu

CPU utilization for five seconds: 99.26%

one minute: 100.00%

five minutes: 100.00%

PID Runtime(ms) Invoked uSecs 5Sec 1Min 5Min TTY Process

--- ----------- ---------- -------- ------- ------- ------- --- ---------------

39 494133621 229147354 121000 94.96% 93.12% 93.00% -2 L3Aging

Thanks,

Andy

[Wilson Samuel]

Hi,

I guess it could be some bug, hence if I were you I would be looking forward to upgrade the next 'stable' CatOS and IOS version or would have made it an IOS only switch.

Regards.

Wilson Samuel

Please rate the post if it helps.

[gpulos]

in this chassis, there are two CPUs. one is the Supervisor CPU (aka NMP or SP) and the other is the Layer3 routingEngine CPU. (aka MSFC or RP)

common causes of high CPU are as follows:

* ip unreachables - these impose a load on the msfc cpu. use the 'no ip unreachables' command to disable these messages. (verify the state of this feature)

* merger of VLANs do to improper cabling - this can result in high CPU if two or more VLANs are merged together with incorrect cabling. if STP is disabled on the ports where the VLAN merger occurs, you could get high CPU. (check all cabling, especially the high bandwidth links as well as server/host connections)

* broadcast storm - either severe number or length of storms can cause high CPU. also, errors in the protocolStack can cause broadcast storms. (reinstall a bad protocolStack if you find/have one; use a sniffer from http://ethereal.com to gather as much info on the traffic & patterns as possible.)

see this link for more info on troublshooting high CPU. there are also some tools to determine the traffice that is sent to the CPU:

http://www.cisco.com/en/US/products/hw/switches/ps708/products_tech_note09186a00804916e0.shtml#utilities

[m-haddad]

New worms has been these kings of flows. Check the below security notice from Cisco.

http://www.cisco.com/en/US/customer/products/sw/voicesw/ps556/products_security_notice09186a00804f51de.html

Let me know if this helps,