CPU high on 4006

[jeftavaneijk]

We have some 4006 with a high CPU utilization. I have search the net but i can´t find a solution.

CPU utilization for five seconds: 90%/5%; one minute: 89%; five minutes: 90%

PID Runtime(ms) Invoked uSecs 5Sec 1Min 5Min TTY Process

1 3441484 3029853 1135 0.00% 0.00% 0.00% 0 SERIAL A'detect

13 0 1 0 0.00% 0.00% 0.00% 0 Critical Bkgnd

14 3591620 2860579 1255 0.00% 0.02% 0.01% 0 Net Background

15 140 233 600 0.00% 0.00% 0.00% 0 Logger

16 13266132 14854394 893 0.00% 0.05% 0.07% 0 TTY Background

17 7719756 14854426 519 0.00% 0.04% 0.02% 0 Per-Second Jobs

18 20 37 540 0.00% 0.00% 0.00% 0 Net Input

19 2713700 3029853 895 0.00% 0.01% 0.00% 0 Compute load avg

20 13145860 252934 51973 0.00% 0.05% 0.05% 0 Per-minute Jobs

21 11747232 8444269 1391 0.32% 0.16% 0.07% 0 IP Input

22 2537936 1766262 1436 0.00% 0.00% 0.00% 0 CDP Protocol

23 4 1 4000 0.00% 0.00% 0.00% 0 X.25 Encaps Mana

24 0 1 0 0.00% 0.00% 0.00% 0 Asy FS Helper

25 0 1 0 0.00% 0.00% 0.00% 0 PPP IP Add Route

26 6732024 267434 25172 0.00% 0.02% 0.00% 0 IP Background

27 136188 252940 538 0.00% 0.00% 0.00% 0 IP RIB Update

28 2088916 252942 8258 0.00% 0.00% 0.00% 0 Adj Manager

29 212784 948997 224 0.00% 0.04% 0.01% 0 TCP Timer

30 1884 290 6496 0.00% 0.00% 0.00% 0 TCP Protocols

31 0 1 0 0.00% 0.00% 0.00% 0 Probe Input

32 28 29 965 0.00% 0.00% 0.00% 0 RARP Input

33 0 1 0 0.00% 0.00% 0.00% 0 HTTP Timer

34 0 1 0 0.00% 0.00% 0.00% 0 Socket Timers

35 896 243 3687 0.00% 0.00% 0.00% 0 DHCPD Receive

36 93348 252536 369 0.00% 0.00% 0.00% 0 IP Cache Ager

37 0 1 0 0.00% 0.00% 0.00% 0 PAD InCall

38 8 2 4000 0.00% 0.00% 0.00% 0 X.25 Background

39 1674380 1581819 1058 0.00% 0.00% 0.00% 0 TACACS+

40 0 1 0 0.00% 0.00% 0.00% 0 SNMP Timers

41 22158136 394290 56197 0.00% 0.03% 0.07% 0 IP SNMP

42 181036 1929 93849 0.00% 0.00% 0.00% 0 SNMP ConfCopyPro

43 48 3 16000 0.00% 0.00% 0.00% 0 SNMP Traps

44 9305064 15241215 610 0.00% 0.05% 0.05% 0 NTP

45 1233107880 545966433 2258 9.19% 11.67% 9.07% 8 Exec

46 136284 126599 1076 0.00% 0.00% 0.00% 0 DHCPD Timer

47 1386144 4279667 323 0.00% 0.00% 0.00% 0 DHCPD Database

48 411779708 545966672 754 3.39% 2.28% 1.99% 5 Exec

49 17740 3346 5301 0.00% 0.05% 1.60% 6 Exec

50 1741895476 545965800 3190 26.77% 25.25% 21.99% 4 Exec

51 2740645504 539820651 5076 27.63% 28.49% 24.04% 3 Exec

52 55944 11441 4889 0.00% 0.73% 5.04% 14 Exec

53 109123716 104789131 1041 2.10% 2.29% 1.96% 9 Exec

54 1608 134 12000 2.91% 1.76% 0.41% 18 Virtual Exec

[kkalaycioglu]

Is this continuous or transient? If you check the output, you'll see that almost 70% of the CPU load is caused bye Exec processes. I tghink there are 3, 4 or 5 concurrent telnet sessions to this switch and running commands etc. You can check these sessions with "sh user".

Regards.

[jeftavaneijk]

It is continuous. I have cleared some tty line´s.

But afther a few minutes evrything is back.

48 149776 32810 4564 34.97% 59.94% 34.11% 10 Exec

49 520 152 3421 0.00% 0.10% 0.10% 5 Exec

50 18652 3207 5816 46.34% 21.23% 5.47% 4 Exec

51 1624 118 13762 7.86% 1.95% 0.45% 18 Virtual Exec

cisassvtp02# sh user

Line User Host(s) Idle Location

4 tty 4 idle 00:00:00

5 tty 5 idle 00:02:11

6 tty 6 idle 00:12:10

8 tty 8 idle 00:03:28

10 tty 10 idle 00:00:00

* 18 vty 0 idle 00:00:00

Interface User Mode Idle Peer Address

[glen.grant]

If you clear these off and they don't show up after clearing them but keep coming back then something is logging into your switches management address and tieing up all the vty sessions . You may have to get a sniffer to see who is doing this . I would be worried if you have this many people trying to logg into these things and you don't know who they are . Whoever is doing this also must know the password to logon to the switch . Also you should have exec-timeout configured on your vty lines so that it will logg these sessions off after so many minutes of inactivity . I would consider immedietly changing the vty login password for this switch .