Showing results for 
Search instead for 
Did you mean: 

ISR 2921, memory leak



Got problem with 2921, it was restarting 2 times automatically(the second time it went down for couple of minutes, only power LED was active, all others down, it repairs  from that state without any interaction), after that it is operaiting normally about 5 day now, but I was restarting it manually, during that time. I was analising statistics, before load and after load with cisco output interpreter, and found that after load its '*Dead*'  process is holding more than 1 MB of ram. This is cisco output interpreter output:

WARNING: The process '*Dead*' is holding more than 1 MB of memory.
  This is considered to be high, and indicates a possible memory leak. The 'Dead'
  process is not a real process. It only accounts for the memory allocated under
  the context of another process which is terminated.
  TRY THIS: If a memory leak is detected, and the 'Dead' process seems to be consuming
  the memory, issue the "show memory dead" command from your device, and analyze
  which process consumes more memory. To do so, look at the "What" section of
  the output. This problem can also be caused due to a Cisco IOS Bug. Review the
  Bug Tool Kit for potential bugs and upgrade the device with the latest version
  of Cisco IOS software. If the problem persists, open a service request with Cisco
  at Service Request Tool.
  INFO: The top 3 processes that are holding less than 1 MB of memory are:
    'l4f mgt task' is holding 988708 bytes
    'Chunk Manager' is holding 715332 bytes
    'VLAN Manager' is holding 440520 bytes

I am interesting is it Normal ? or could it be the possible reason for router automatic restarting ?

In production network it was operating under small load.

It is running c2900-universalk9-mz.SPA.150-1.M5.bin. Also c2900-universalk9-mz.SPA.151-4.M.bin was installed for cheking but without any results.

1 Accepted Solution

Accepted Solutions

It can be normal to see the Dead process holding memory.  The Dead process is simply a holding area for memory that was allocated by a process that was released and the memory is still being used.  A good example of Dead memory usage is when you telnet into a router, make a config change then kill the telnet session.  When you initually telnet into the router a Virtual Exec process is created to deal with the telnet session.  While telneted in, if you go into config mode and increase the logging buffered to say 10mb then 10mb of memory will be allocated for the log.  The allocation happened under the Virtual Exec process (a show mem proc would show Virtual Exec holding 10mb).  When the telnet session is killed, the memory allocated by Virtual Exec is still needed, therefore the 10mb is moved to the Dead process and the Virtual Exec process is removed.   Now, if the router is rebooted, the 10mb allocated for the Log will now show up under the Init process (Init allocates memory when the router is booting).

Seeing 1mb in Dead is nothing to be concerned about.  If you saw 30mb or more then it may warrent a closer look.  As far as the router rebooting, a show version will tell you when the last reboot occurred and the reason for it.  If it was a crash, you should see the reboot reason be something like "Bus error" or "Segv".  A crash should also result in a  crashinfo being produced and saved to the flash.


View solution in original post

9 Replies 9

paolo bevilacqua
Hall of Fame Master Hall of Fame Master
Hall of Fame Master

It is not said (but certainly possible) that the crashes are related to the memory leak.

To know, you must engage the TAC, ask for escalation and intepretation of crash files.