Cisco SG200-26P high CPU utilization.

[Andrew Kolchoogin]

Hi there!

We have unusual troubles with SG200 series switches (we have 26P, 26FP and 50P models): time-to-time network become very slow, and Web GUI shows very high CPU utilization.

We also have Zabbix monitoring deployed on network. Port utilization graphs have "holes" at times with CPU utilization peaks -- perhaps SNMP doesn't work correctly under CPU pressure.

What should we do to debug switches behaviour -- what process hogs CPU and why?

Thank you in advance!

[Mark Malone]

when a switch/router is over utilized the first traffic to be dropped will be management traffic , it will do its best to push through critical traffic 

can you post the output from section administration-diagnostics-cpu/memory utilization as the issue is occurring

There are multiple processes that can hog a cpu first need to identify what

You should be able to access via console as well if so you can do a show proc cpu sorted during the issue , cpu problems need to be captured as there occurring

[Andrew Kolchoogin]

Unfortunately, SG200 series of switches has no command line -- I do know about 's proc cpu sorted' available on "larger" switches. :)

Also, SG200 doesn't have memory utilization information, and all information available about CPU was posted as attach to my first message.

Are there any debugging mechanisms available for this series of switches?

[Mark Malone]

The only debug section is to go to administration-system settings-log settings , debug can be turned on there whether it produces any useful outputs for you , your right checking the specs console only available for sg300s and up which really limits your debugging capabilities and that cpu output is fairly useless from switch does not show the processes just the amount its risen , can you enable the debugs for logs see if anything else is provided

[Andrew Kolchoogin]

I have reconfigured syslog server and RAM logging to include all levels including "debug".

But there are no messages with this priority logged so far.

What else could I do?

[Mark Malone]

Is there anything showing up in your ram/flash logs in status and statistics - view log

[Andrew Kolchoogin]

Exactly the same that has been logged by remote syslog:

Jun  2 14:42:37 <local6.notice> 10.132.3.94 1 2015-03-30T11:13:32+01:00 cs-sg200-26p-academia-lower SYSLOG - SYSLOGCHANGE - %SYSLOG-N-SYSLOGCHANGE: syslog server 10.132.3.3 configuration changed  
Jun  2 14:44:37 <local6.notice> 10.132.3.94 1 2015-03-30T11:15:32+01:00 cs-sg200-26p-academia-lower SYSLOG - LOGGINGBFR - %SYSLOG-N-LOGGINGBFR: configure  buffer logging level to 7.  
Jun  2 15:06:05 <local6.info> 10.132.3.94 1 2015-06-02T14:06:05+01:00 cs-sg200-26p-academia-lower COPY - FILECPY - %COPY-I-FILECPY: Files Copy - source URL running-config destination URL flash://startup-config  
Jun  2 15:06:10 <local6.notice> 10.132.3.94 1 2015-06-02T14:06:09+01:00 cs-sg200-26p-academia-lower COPY - TRAP - %COPY-N-TRAP: The copy operation was completed successfully  
Jun  2 15:09:34 <local6.info> 10.132.3.94 1 2015-06-02T14:09:33+01:00 cs-sg200-26p-academia-lower AAA - CONNECT - %AAA-I-CONNECT: New http connection for user cisco, source 10.132.3.3 destination 10.132.3.94 ACCEPTED  
Jun  2 15:10:47 <local6.info> 10.132.3.94 1 2015-06-02T14:10:46+01:00 cs-sg200-26p-academia-lower AAA - DISCONNECT - %AAA-I-DISCONNECT: http connection for user cisco, source 10.132.3.3 destination 10.132.3.94 TERMINATED  
Jun  2 16:05:34 <local6.warn> 10.132.3.94 1 2015-06-02T15:05:34+01:00 cs-sg200-26p-academia-lower LINK - Down - %LINK-W-Down:  gi2  

[Mark Malone]

Are you currently still getting high cpu as the debugs should only come in as the issue happens ,  if your still not seeing anything im not sure these devices are limited without console access to what you can troubleshoot