cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
3072
Views
0
Helpful
1
Replies

ASR 1002-F SYS-4-CHUNKSIBLINGSEXCEED

eddschulz
Level 1
Level 1

Hi,

we are running about 10 ASR1002-F as IPSEC Concentrators

with IOS 

(PPC_LINUX_IOSD-ADVENTERPRISEK9-M), Version 15.1(2)S2, RELEASE SOFTWARE (fc1)

Now we are getting on some of our ASRs, the following syslog outputs, in a quite regular base:

Mar   6 08:54:55.090 MET: %SYS-4-CHUNKSIBLINGSEXCEED: Number of siblings in a  chunk has gone above the threshold. Threshold:10000 Sibling-Count:17483  Chunk:0x3BDE17A4 Name:Crypto requests -Process= "IPSEC key engine",  ipl= 2, pid= 326

Mar  6 09:09:23.591 MET: %SYS-4-CHUNKSIBLINGSEXCEED: Number of  siblings in a chunk has gone above the threshold. Threshold:10000  Sibling-Count:17484 Chunk:0x3BDE17A4 Name:Crypto requests -Process=  "Crypto IKMP", ipl= 2, pid= 324

Mar  6 09:18:19.959 MET:  %SYS-4-CHUNKSIBLINGSEXCEED: Number of siblings in a chunk has gone above  the threshold. Threshold:10000 Sibling-Count:17485 Chunk:0x3BDE17A4  Name:Crypto requests -Process= "Crypto Support", ipl= 2, pid= 305

Mar   6 09:28:21.508 MET: %SYS-4-CHUNKSIBLINGSEXCEED: Number of siblings in a  chunk has gone above the threshold. Threshold:10000 Sibling-Count:17486  Chunk:0x3BDE17A4 Name:Crypto requests -Process= "Crypto IKMP", ipl= 2,  pid= 324

Mar  6 09:38:54.563 MET: %SYS-4-CHUNKSIBLINGSEXCEED:  Number of siblings in a chunk has gone above the threshold.  Threshold:10000 Sibling-Count:17487 Chunk:0x3BDE17A4 Name:Crypto  requests -Process= "Crypto IKMP", ipl= 2, pid= 324

Mar  6  09:48:19.278 MET: %SYS-4-CHUNKSIBLINGSEXCEED: Number of siblings in a  chunk has gone above the threshold. Threshold:10000 Sibling-Count:17488  Chunk:0x3BDE17A4 Name:Crypto requests -Process= "Crypto IKMP", ipl= 2,  pid= 324

Mar  6 09:58:14.513 MET: %SYS-4-CHUNKSIBLINGSEXCEED:  Number of siblings in a chunk has gone above the threshold.  Threshold:10000 Sibling-Count:17489 Chunk:0x3BDE17A4 Name:Crypto  requests -Process= "Crypto Support", ipl= 2, pid= 305

Thus the messages occures, we get some problems with the dmvpn tunnels.

Any idea what the problem might be?

regards

Eberhard

1 Reply 1

Rozsa Illes
Cisco Employee
Cisco Employee

Hello Eberhard,

Do you have SNMP to poll IPSec/ISAKMP? The errors are similar to the following bug which is causing a slow memory leak:

CSCtw80533

Memory leak due to crypto_allocate_ce_request

First fixed in versions:

15.2(03.01)T 15.2(02.14)PI19b 15.2(01.18)S0.11 15.2(01)S01 15.2(01)S0.10 15.1(03)S2.7

Warm Regards,

Rose

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Innovations in Cisco Full Stack Observability - A new webinar from Cisco