Solved: Re: ISR 2921, memory leak

ngtransge · ‎05-31-2011

Hello,

Got problem with 2921, it was restarting 2 times automatically(the second time it went down for couple of minutes, only power LED was active, all others down, it repairs from that state without any interaction), after that it is operaiting normally about 5 day now, but I was restarting it manually, during that time. I was analising statistics, before load and after load with cisco output interpreter, and found that after load its '*Dead*' process is holding more than 1 MB of ram. This is cisco output interpreter output:

WARNING: The process '*Dead*' is holding more than 1 MB of memory.
This is considered to be high, and indicates a possible memory leak. The 'Dead'
process is not a real process. It only accounts for the memory allocated under
the context of another process which is terminated.
TRY THIS: If a memory leak is detected, and the 'Dead' process seems to be consuming
the memory, issue the "show memory dead" command from your device, and analyze
which process consumes more memory. To do so, look at the "What" section of
the output. This problem can also be caused due to a Cisco IOS Bug. Review the
Bug Tool Kit for potential bugs and upgrade the device with the latest version
of Cisco IOS software. If the problem persists, open a service request with Cisco
at Service Request Tool.

INFO: The top 3 processes that are holding less than 1 MB of memory are:
    'l4f mgt task' is holding 988708 bytes
    'Chunk Manager' is holding 715332 bytes
    'VLAN Manager' is holding 440520 bytes

I am interesting is it Normal ? or could it be the possible reason for router automatic restarting ?

In production network it was operating under small load.

It is running c2900-universalk9-mz.SPA.150-1.M5.bin. Also c2900-universalk9-mz.SPA.151-4.M.bin was installed for cheking but without any results.

Timothy Stewart · ‎06-01-2011

It can be normal to see the Dead process holding memory. The Dead process is simply a holding area for memory that was allocated by a process that was released and the memory is still being used. A good example of Dead memory usage is when you telnet into a router, make a config change then kill the telnet session. When you initually telnet into the router a Virtual Exec process is created to deal with the telnet session. While telneted in, if you go into config mode and increase the logging buffered to say 10mb then 10mb of memory will be allocated for the log. The allocation happened under the Virtual Exec process (a show mem proc would show Virtual Exec holding 10mb). When the telnet session is killed, the memory allocated by Virtual Exec is still needed, therefore the 10mb is moved to the Dead process and the Virtual Exec process is removed. Now, if the router is rebooted, the 10mb allocated for the Log will now show up under the Init process (Init allocates memory when the router is booting).

Seeing 1mb in Dead is nothing to be concerned about. If you saw 30mb or more then it may warrent a closer look. As far as the router rebooting, a show version will tell you when the last reboot occurred and the reason for it. If it was a crash, you should see the reboot reason be something like "Bus error" or "Segv". A crash should also result in a crashinfo being produced and saved to the flash.

Tim

View solution in original post

paolo bevilacqua · ‎05-31-2011

It is not said (but certainly possible) that the crashes are related to the memory leak.

To know, you must engage the TAC, ask for escalation and intepretation of crash files.