WAN router CPU @ 80% causing problems - please assist

[Steve Coady]

My WAN router CPU had massive spike

CPU utilization for five seconds: 80%/68%; one minute: 60%; five minutes: 62%
 PID Runtime(ms)   Invoked      uSecs   5Sec   1Min   5Min TTY Process
  87    33845184-225308168          0  0.81%  0.73%  0.76%   0 IP SLA Mon Event
  39   369005648 176573942       2089  0.40%  0.39%  0.40%   0 Per-Second Jobs  
   5   216170736  21223865      10185  0.40%  0.14%  0.08%   0 Check heaps      
 208        4340       497       8732  0.24%  0.04%  0.09%   0 Exec             
 138    190964441078152403         17  0.16%  0.16%  0.16%   0 IP SLA Mon Respo
  81   268436924 663445230        404  0.08%  0.15%  0.19%   0 IP Input        

[Joseph W. Doherty · Accepted solution]

Disclaimer

The Author of this posting offers the information contained within this posting without consideration and with the reader's understanding that there's no implied or expressed suitability or fitness for any purpose. Information provided is for informational purposes only and should not be construed as rendering professional advice of any kind. Usage of this posting's information is solely at reader's own risk.

Liability Disclaimer

In no event shall Author be liable for any damages whatsoever (including, without limitation, damages for loss of use, data or profit) arising out of the use or inability to use the posting's information even if Author has been advised of the possibility of such damage.

Posting

Your five second values, show most CPU is interrupt CPU, which usually is due to packet forwarding.  What's the router model and the total transit traffic volume?

Also, your process CPU is a tad high for the 5 second measurement.  Is the spread normally about 12%?  What do you see if you sort the CPU utilization list?

[Steve Coady]

Joe

Not sure if 12% diff is nromal

Router model is 3725

3725#sh proc cpu sorted
CPU utilization for five seconds: 64%/63%; one minute: 62%; five minutes: 61%
 PID Runtime(ms)   Invoked      uSecs   5Sec   1Min   5Min TTY Process
  39       16436      2304       7133  0.40%  0.38%  0.35%   0 Per-Second Jobs  
 214        1180    142426          8  0.24%  0.19%  0.18%   0 IP SLA Mon Respo
  81       43032     22332       1926  0.24%  0.25%  0.24%   0 IP Input         
  87        7388      2615       2825  0.16%  0.17%  0.08%  98 SSH Process      
 138        3612       267      13528  0.16%  0.05%  0.18%   0 Exec             
 122          16      2299          6  0.08%  0.00%  0.00%   0 bsm_xmt_proc     
 108         160      3446         46  0.08%  0.01%  0.00%   0 CEF process      
 135         192     22832          8  0.08%  0.03%  0.02%   0 RBSCP Background
   8           0        41          0  0.00%  0.00%  0.00%   0 IPC Dynamic Cach
   6           0         5          0  0.00%  0.00%  0.00%   0 Pool Manager     
   7           4         2       2000  0.00%  0.00%  0.00%   0 Timers           
   9           0         1          0  0.00%  0.00%  0.00%   0 IPC Zone Manager
  10          28      2300         12  0.00%  0.00%  0.00%   0 IPC Periodic Tim
  14           0         1          0  0.00%  0.00%  0.00%   0 OIR Handler      
  15           0         1          0  0.00%  0.00%  0.00%   0 Crash writer     
  11          12      2300          5  0.00%  0.00%  0.00%   0 IPC Deferred Por
  17         512      1012        505  0.00%  0.00%  0.00%   0 ARP Input        
  12           0         1          0  0.00%  0.00%  0.00%   0 IPC Seat Manager

[Joseph W. Doherty]

Disclaimer

The Author of this posting offers the information contained within this posting without consideration and with the reader's understanding that there's no implied or expressed suitability or fitness for any purpose. Information provided is for informational purposes only and should not be construed as rendering professional advice of any kind. Usage of this posting's information is solely at reader's own risk.

Liability Disclaimer

In no event shall Author be liable for any damages whatsoever (including, without limitation, damages for loss of use, data or profit) arising out of the use or inability to use the posting's information even if Author has been advised of the possibility of such damage.

Posting

Ok, assuming it's not, what you're aggregate traffic volume (as about 50 Mbps could max out a 3725).

[Steve Coady]

Joe

Thank you for the response.

We thought it might be the router having issues. it is a 3725 and had not been rebooted in 5 .5 years.

We replaced the router with a newer 3825. The same issue is occurring. Something with

SNMP is spiking the processor to 80-100%

Any ideas on what could be causing that. This is a new development within the last couple days.

[Nicholas Poole · Accepted solution]

Do you have ACL restrictions on SNMP to allow only your servers?

Do you have CoPP enabled?