topic Re: High CPU usage on our CISCO ROUTER in Network Security

High CPU usage on our CISCO ROUTER

tnkurunziza — Mon, 12 Aug 2019 15:02:17 GMT

Hello,

We are experiencing a high usage CPU on one of our routers. We checked the cpu usage per process and we found that IP Input process is the one with high cpu usage. We would like your support in order to fix this issue.

Thank you in advance.

Re: High CPU usage on our CISCO ROUTER

balaji.bandi — Mon, 12 Aug 2019 15:45:29 GMT

what is the model of the router ? what is IOS version

can you post show process cpu | ex 0.00%

show processes cpu sorted

Re: High CPU usage on our CISCO ROUTER

tnkurunziza — Tue, 13 Aug 2019 07:20:16 GMT

our router model is as below:

show version
Cisco IOS Software, 3800 Software (C3845-ADVIPSERVICESK9-M), Version 15.0(1)M7, RELEASE SOFTWARE (fc2)

and HW type is as below:

-------------------------------------------------
Device# PID SN
-------------------------------------------------
*0 CISCO3845-MB FOC153325D0

Below is the result of command show process cpu | ex 0.00%:

RT_OBR_PORT_01#show processes cpu | ex 0.00%
CPU utilization for five seconds: 97%/39%; one minute: 96%; five minutes: 92%
PID Runtime(uS) Invoked uSecs 5Sec 1Min 5Min TTY Process
41 2080648000 1480460 1405 0.23% 0.22% 0.23% 0 Net Background
45 1623526112 1195960 12131 1.27% 1.27% 1.27% 0 Per-Second Jobs
83 228000 279 817 0.07% 0.12% 0.05% 706 SSH Process
129 115040000 36780683 3 0.07% 0.06% 0.07% 0 IPAM Manager
133 2024751424 818709436 296 55.35% 54.42% 53.42% 0 IP Input
206 735628000 288782077 2 0.39% 0.39% 0.39% 0 HQF Shaper Backg
325 371188000 98134022 3 0.31% 0.25% 0.24% 0 CH_GT96K Backgro

Re: High CPU usage on our CISCO ROUTER

Leo Laohoo — Tue, 13 Aug 2019 07:21:00 GMT

What is the exact model of the router?
What is the WAN bandwidth?

Re: High CPU usage on our CISCO ROUTER

tnkurunziza — Tue, 13 Aug 2019 08:44:42 GMT

WAN bandwidth is 60 Mbps. The exact model of the router is C3845. Below is the result of show version:
RT_OBR_PORT_01#show version
Cisco IOS Software, 3800 Software (C3845-ADVIPSERVICESK9-M), Version 15.0(1)M7, RELEASE SOFTWARE (fc2)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2011 by Cisco Systems, Inc.
Compiled Thu 04-Aug-11 23:45 by prod_rel_team

ROM: System Bootstrap, Version 12.4(13r)T15, RELEASE SOFTWARE (fc1)

RT_OBR_PORT_01 uptime is 1 week, 6 days, 1 hour, 57 minutes
System returned to ROM by power-on
System image file is "flash:c3845-advipservicesk9-mz.150-1.M7.bin"
Last reload type: Normal Reload

This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
Importers, exporters, distributors and users are responsible for
compliance with U.S. and local country laws. By using this product you
agree to comply with applicable laws and regulations. If you are unable
to comply with U.S. and local laws, return this product immediately.

A summary of U.S. laws governing Cisco cryptographic products may be found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html

If you require further assistance please contact us by sending email to
export@cisco.com.

Cisco 3845 (revision 1.0) with 446463K/77824K bytes of memory.
Processor board ID FGL153910Q3
8 FastEthernet interfaces
2 Gigabit Ethernet interfaces
31 Serial interfaces
2 Channelized E1/PRI ports
2 Virtual Private Network (VPN) Modules
DRAM configuration is 64 bits wide with parity enabled.
447K bytes of NVRAM.
126976K bytes of ATA System CompactFlash (Read/Write)

License Info:

License UDI:

-------------------------------------------------
Device# PID SN
-------------------------------------------------
*0 CISCO3845-MB FOC153325D0

Configuration register is 0x2102

RT_OBR_PORT_01#

Re: High CPU usage on our CISCO ROUTER

Leo Laohoo — Tue, 13 Aug 2019 10:00:28 GMT

Post the complete output to the command "sh interface <WAN PORT>".

Re: High CPU usage on our CISCO ROUTER

tnkurunziza — Tue, 13 Aug 2019 12:29:39 GMT

RT_OBR_PORT_01#show int gi0/1
GigabitEthernet0/1 is up, line protocol is up
Hardware is BCM1125 Internal MAC, address is 2037.0646.a381 (bia 2037.0646.a381)
Description: *** LINK PORT-EMMAUS ***
Internet address is 10.100.13.129/25
MTU 1500 bytes, BW 20000 Kbit/sec, DLY 10 usec,
reliability 255/255, txload 150/255, rxload 224/255
Encapsulation ARPA, loopback not set
Keepalive set (10 sec)
Full-duplex, 1000Mb/s, media type is RJ45
output flow-control is XON, input flow-control is XON
ARP type: ARPA, ARP Timeout 04:00:00
Last input 00:00:00, output 00:00:00, output hang never
Last clearing of "show interface" counters never
Input queue: 16/75/2063/65306483 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo
Output queue: 0/40 (size/max)
5 minute input rate 17642000 bits/sec, 3729 packets/sec
5 minute output rate 11796000 bits/sec, 3460 packets/sec
2055088211 packets input, 3226230772 bytes, 11 no buffer
Received 20105 broadcasts, 0 runts, 0 giants, 166 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 watchdog, 99691 multicast, 0 pause input
0 input packets with dribble condition detected
2393538283 packets output, 3413193735 bytes, 0 underruns
0 output errors, 0 collisions, 1 interface resets
20105 unknown protocol drops
0 babbles, 0 late collision, 0 deferred
1 lost carrier, 0 no carrier, 0 pause output
0 output buffer failures, 0 output buffers swapped out
RT_OBR_PORT_01#show int gi0/0
GigabitEthernet0/0 is up, line protocol is up
Hardware is BCM1125 Internal MAC, address is 2037.0646.a380 (bia 2037.0646.a380)
Description: *** LIAISON CORE SWITCH PORT ***
Internet address is 10.102.246.13/28
MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec,
reliability 255/255, txload 4/255, rxload 2/255
Encapsulation ARPA, loopback not set
Keepalive set (10 sec)
Full-duplex, 1000Mb/s, media type is RJ45
output flow-control is XON, input flow-control is XON
ARP type: ARPA, ARP Timeout 04:00:00
Last input 00:00:00, output 00:00:00, output hang never
Last clearing of "show interface" counters never
Input queue: 0/75/0/22324 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo
Output queue: 0/40 (size/max)
5 minute input rate 11474000 bits/sec, 3532 packets/sec
5 minute output rate 16779000 bits/sec, 3717 packets/sec
2636924773 packets input, 2733830709 bytes, 0 no buffer
Received 569930 broadcasts, 0 runts, 0 giants, 0 throttles
242 input errors, 0 CRC, 0 frame, 242 overrun, 0 ignored
0 watchdog, 9832615 multicast, 0 pause input
0 input packets with dribble condition detected
2022625561 packets output, 267457581 bytes, 0 underruns
11 output errors, 0 collisions, 1 interface resets
20086 unknown protocol drops
0 babbles, 0 late collision, 0 deferred
13 lost carrier, 0 no carrier, 0 pause output
0 output buffer failures, 0 output buffers swapped out
RT_OBR_PORT_01#

Re: High CPU usage on our CISCO ROUTER

tnkurunziza — Tue, 13 Aug 2019 15:18:21 GMT

Most of our traffic including Internet and WAN traffic are going through int gi0/1. Below is the result of show ip int brief:

RT_OBR_PORT_01#show ip int brief
Interface IP-Address OK? Method Status Protocol
GigabitEthernet0/0 10.102.246.13 YES NVRAM up up
GigabitEthernet0/1 10.100.13.129 YES NVRAM up up
FastEthernet0/0/0 unassigned YES unset up down
FastEthernet0/0/1 unassigned YES unset up down
FastEthernet0/0/2 unassigned YES unset up down
FastEthernet0/0/3 unassigned YES unset up down
FastEthernet0/1/0 unassigned YES unset up down
FastEthernet0/1/1 unassigned YES unset up down
FastEthernet0/1/2 unassigned YES unset up down
FastEthernet0/1/3 unassigned YES unset up down
Serial0/2/0:0 unassigned YES unset down down
Serial0/2/0:1 unassigned YES unset down down
Serial0/2/0:2 unassigned YES unset up up
Serial0/2/0:3 unassigned YES unset down down
Serial0/2/0:4 unassigned YES unset down down
Serial0/2/0:5 unassigned YES unset up up
Serial0/2/0:6 unassigned YES unset down down
Serial0/2/0:7 unassigned YES unset down down
Serial0/2/0:8 unassigned YES unset down down
Serial0/2/0:9 unassigned YES unset down down
Serial0/2/0:10 unassigned YES unset down down
Serial0/2/0:11 unassigned YES unset down down
Serial0/2/0:12 unassigned YES unset down down
Serial0/2/0:13 unassigned YES unset down down
Serial0/2/0:14 unassigned YES unset down down
Serial0/2/0:15 unassigned YES NVRAM up up
Serial0/2/0:16 unassigned YES unset down down
Serial0/2/0:17 unassigned YES unset down down
Serial0/2/0:18 unassigned YES unset down down
Serial0/2/0:19 unassigned YES unset down down
Serial0/2/0:20 unassigned YES unset down down
Serial0/2/0:21 unassigned YES unset down down
Serial0/2/0:22 unassigned YES unset down down
Serial0/2/0:23 unassigned YES unset down down
Serial0/2/0:24 unassigned YES unset down down
Serial0/2/0:25 unassigned YES unset down down
Serial0/2/0:26 unassigned YES unset down down
Serial0/2/0:27 unassigned YES unset down down
Serial0/2/0:28 unassigned YES unset down down
Serial0/2/0:29 unassigned YES unset down down
Serial0/2/0:30 unassigned YES unset down down
Loopback251 10.100.2.251 YES NVRAM up up
NVI0 10.100.2.251 YES unset up up
Tunnel4 172.16.4.9 YES NVRAM up down
Tunnel6 172.20.1.5 YES NVRAM up up
Tunnel10 172.16.2.2 YES NVRAM up up
Tunnel12 172.16.3.49 YES NVRAM up down
Vlan1 unassigned YES NVRAM up down
Vlan2 10.100.18.62 YES NVRAM up down
Vlan4 10.100.19.62 YES NVRAM up down
RT_OBR_PORT_01#

Re: High CPU usage on our CISCO ROUTER

Leo Laohoo — Wed, 14 Aug 2019 06:51:36 GMT

reliability 255/255, txload 150/255, rxload 224/255

Is QoS enabled?

RxLoad is pretty high. I believe the cause of the High CPU is that your router has hit the limit.

No Total Output Drops probably means QoS is enabled or the WAN link is higher than the limits of the router.