hight utilization cpu router 2811

[Roberto Casagrande]

Hi, I have a problem with router 2811 , hight utilization CPU but I don't determinated the process . See the attached file (now is not very hight but before I had more then 65 % ). In this case when don't see the process who cause the utilization CPU , what can I do? thanks a lot for the help !!

CPU% per second (last 60 seconds)

6468764444456344437576679666776653468677886969876667755666
4240374051292937258818710645525299854215928073521011298134
100
90 * * * **
80 * * * * * *#* * **
70 #** * ***##* *#** ** *##**#*##* ** *
60 * *#** ** *############** ######*############*#####
50 # #### * ** * #############** *######*##################
40 #######*#**##**#**###############*##########################
30 ############################################################
20 ############################################################
10 ############################################################
0....5....1....1....2....2....3....3....4....4....5....5....
0 5 0 5 0 5 0 5 0 5

[chrihussey]

Next time this happens use the "sh proc c | e 0.00" command. You should only see the higher utilized processes. Also, check the utilization of all the interfaces. Might be a high traffic issue.

May want to post the config too, as it would help to know what services are running (routing protocols, VPN, NAT, etc).

[Roberto Casagrande]

thanks for your replay.

the cfg is same of other routers that I have in my company. I have posted output that you suggested.

I have a vpn , no nat . I have disabled all logging net flow and so on.
The question , why does high CPU, but the process can not be seen ?

grazie 1k

[chrihussey]

Understand your question. It is possible it could be a process not used by the IOS daemon so that's why you aren't seeing it.

It looks like your average CPU in normal operation is around 40%.  The # represents the CPU average and the * is the maximum. Those maximum spikes could be very brief and tough to actually see and when it spikes it's on average only 20% more. That being said, run the same command when it's happening again (sh proc c | e 0.00) and look for increased throughput on the interfaces and you may find your answer.

Also, here's a link that may help:

https://www.cisco.com/c/en/us/support/docs/routers/10000-series-routers/15095-highcpu.html

[Joseph W. Doherty]

Do you see the two CPU percentages for the last 5 seconds? The second value is interrupt CPU, and represents the work of forwarding packets in the "fast path". Ideally, this value should be within a few percentage points of the first number.

Often interrupt CPU just represents the performance of the router relative to the traffic transiting it. Keep in mind the 2811 tops out at about 50 Mbps, but is working load should be kept to about 10 Mbps. (Yea, it has 100 Mbps interfaces, but it doesn't offer 100 Mbps capacity.)

What's your aggregate bandwidth going through the 2811 when the CPU goes up to higher percentages?

[Roberto Casagrande]

Sorry for my late response.

now I have a this situation in the router:

CPU utilization for five seconds: 48%/32%; one minute: 52%; five minutes: 53%

Please see the outpot of the command sh inter summary

 *: interface is up
 IHQ: pkts in input hold queue     IQD: pkts dropped from input queue
 OHQ: pkts in output hold queue    OQD: pkts dropped from output queue
 RXBS: rx rate (bits/sec)          RXPS: rx rate (pkts/sec)
 TXBS: tx rate (bits/sec)          TXPS: tx rate (pkts/sec)
 TRTL: throttle count

  Interface              IHQ   IQD  OHQ   OQD  RXBS RXPS  TXBS TXPS TRTL
------------------------------------------------------------------------
* FastEthernet0/0          0     0    0     0  4000    5  4000    4    0
* FastEthernet0/0.1        -     -    -     -     -    -     -    -   -
* FastEthernet0/0.101      -     -    -     -     -    -     -    -   -
* FastEthernet0/1          0  2025    0     0 5114000  1220 5093000  1113  225
* FastEthernet0/1.1        -     -    -     -     -    -     -    -   -
* FastEthernet0/1.5        -     -    -     -     -    -     -    -   -
* FastEthernet0/1.9        -     -    -     -     -    -     -    -   -
* FastEthernet0/1.11       -     -    -     -     -    -     -    -   -
* FastEthernet0/1.20       -     -    -     -     -    -     -    -   -
* FastEthernet0/1.101      -     -    -     -     -    -     -    -   -
* FastEthernet0/1.102      -     -    -     -     -    -     -    -   -
  FastEthernet0/1.1001     -     -    -     -     -    -     -    -   -
  Serial0/0/0              0     0    0     0     0    0     0    0    0
* Loopback0                0     0    0     0     0    0     0    0    0
* Loopback1                0     0    0     0     0    0     0    0    0
* Loopback3                0     0    0     0     0    0     0    0    0
* Tunnel0                  0     0    0     2 707000  209 268000  200    0
* Tunnel1                  0     0    0     0 1215000  118 67000   94    0
* Tunnel2                  0     0    0    33     0    0     0    0    0
* Tunnel10                 0     0    0     0     0    0     0    0    0
NOTE:No separate counters are maintained for subinterfaces
     Hence Details of subinterface are not shown

[paul driver]

Hello

Are you running dynamic or static routing?

sh ip route summary 

res

paul

[Roberto Casagrande]

thanks

sh ip route summ
IP routing table name is Default-IP-Routing-Table(0)
IP routing table maximum-paths is 16
Route Source    Networks    Subnets     Overhead    Memory (bytes)
connected       0           16          1152        2176
static          0           10          720         1360
eigrp 1         1           0           72          136
internal        8                                   9248
Total           9           26          1944        12920

[Joseph W. Doherty]

If you're running traffic across tunnels, and if the router is fragmenting packets, that will drive your CPU higher than normal.

48 - 32 = 16% of process CPU, which is a bit higher than desired. You need to identify if there are also any software processes using high CPU.

I also see f0/1 has some IQD, which often indicates the router is not keeping up with traffic bursts.