understanding show process cpu sorted 1min command

[mirehteshamali]

Hi all

here  the top line reads  one minutes as 39%  but  when  i add indivudual  entities it is approximately  3 % . i am sure i am missing some thing here ..

Please let me understand how to interprest this command as a core netwrok device it  is really very important to know  processor  intensive  process running in a router.

#show processes cpu sorted 1min | ex 0.00

CPU utilization for five seconds: 41%/38%; one minute: 39%; five minutes: 38%

PID Runtime(ms)   Invoked      uSecs   5Sec   1Min   5Min TTY Process

  96    18710144  52283739        357  1.72%  1.71%  1.69%   0 IP Input

262     4584632   4293029       1067  0.98%  1.12%  0.97%   0 IP NAT Ager

270     2269176  47993115         47  0.24%  0.26%  0.29%   0 NAT MIB Helper

  87       11024  13181877          0  0.08%  0.07%  0.08%   0 EAP Framework

  41       20944    423648         49  0.08%  0.06%  0.08%   0 Per-Second Jobs

  81         112       127        881  0.08%  0.05%  0.01% 450 Virtual Exec

   2       14680     84566        173  0.08%  0.04%  0.02%   0 Load Meter

163        7512   4221110          1  0.08%  0.03%  0.02%   0 RBSCP Background

[mirehteshamali]

i think  only  tac can interpret  this type of show command  , though it  quickly gives what was cpu utilization during last one minute

[Steve Fuller]

Hi,

The 5-second CPU utilisation figure is made up of two numbers, that being the total CPU utilisation and the interrupt based utilisation. In your case we see 41% total utilisation and 38% interrupt utilisation. The total utilisation is self explanatory. The interrupt utilisation is the CPU utilisation used by the router for the forwarding of traffic.

The difference between the two numbers, in this case 3%, is the utilisation  for each of the processes with a non-zero value within the process  table. In your case we see 1.72% for IP Input, 0.98% for IP NAT Mgr,  0.24% for NAT MIB helper, and 0.08% for each of the EAP Framework,  Per-Second Jobs, Virtual Exec and Load Meter. These processes come to  3.26% which is approximately the difference between the 41% and 38% you  see.

In the output you pasted above, the majority of processor utilisation  is due to forwarding of traffic rather than any single process within  the process table. The higher the rate of traffic being forwarded, the  higher the second number will be. If this command was run during your  business day or at a time when you expect traffic through the router,  then I wouldn't be overly concerned about the utilisation of 41%. If you run the same command at different times of the day i.e., after business hours, you'll likely see much lower utilisation.

You don't mention the platform type, but if you need additional  information on troubleshooting a specific platform then a Google search  for site:cisco.com understanding cpu utilisation should yield some useful results.

Regards