High CPU utilization

[enriquebs]

Hi all,

We've a 7304 PE router which use to be running between 5% and 10%. From two days ago CPU utilization is over 50%. No changes, no new services, no reason for a behaviour like this. By the way, here is the "sh proc cpu sort" output:

CPU utilization for five seconds: 52%/2%; one minute: 50%; five minutes: 51%

PID Runtime(ms) Invoked uSecs 5Sec 1Min 5Min TTY Process

215 161394004 20218678 7982 38.87% 38.41% 38.28% 0 IGMP Input

242 584 1182 494 3.83% 0.33% 0.11% 4 SSH Process

91 18176172 174217997 104 0.87% 0.68% 0.66% 0 IP Input

224 18170720 12802897 1419 0.87% 1.04% 1.12% 0 SNMP ENGINE

51 31487068 5115557 6155 0.71% 0.79% 0.79% 0 Compute load avg

243 1100 1326 829 0.71% 0.08% 0.04% 5 SSH Process

[enriquebs]

By the way, any idea about what "IGMP input" process deals with? seems Multicast, but... is it referring to multicast traffic entering through any interface?

thx a lot in advance

[Danilo Dy]

You have high IGMP CPU utilization.

You may have add something in the network like;

Stacking Catalyst Switches

Clustered firewall

?

[enriquebs]

And... why a change like that could affect the "IGMP input" process? I thought that process dealt with Multicast traffic... anyway we haven't attached any device directly to the PE router.

thx

[albert.remo]

Hi!

You're router seems to be hitting an IGMP multicast flood. Issue a "show ip traffic" to verify this. Then check interfaces that has an unusual input traffic going through your router. Issue an "ip accounting" command on this interface and the "show ip accounting" to check source IP's that maybe flooding your network. Know what was the last change done on your router. Check your router for multicast misconfiguration. Check for attached devices that could be Multicast Flooding this router.

Hope this helps,

Regards,

Albert

[enriquebs]

There are some interface tunnels running on a high utilization:

reliability 255/255, txload 255/255, rxload 255/255

We have the same thing on other PEs and CPU is beneath 5%...

By the way, some changes have been done on the CLASS-VC level, and some PVCs have been removed and added... so maybe this affect the router performance...