I was looking at a show proc CPU history on a 3850 (IOS-XE) switch and I see short CPU spikes. Average CPU is not really high, between 40% and 50%.
Also, I was reading this about NX-OS :
The Cisco NX-OS operating system takes advantage of preemptive CPU multitasking, so processes can take advantage of an idle CPU in order to complete tasks faster. Therefore, the history option may report CPU spikes that do not necessarily indicate a problem.
Does anyone knows if the same applies to IOS-XE ?
NX-OS is a different NOS for a different set of plaforms (Nexus devices).
However, this can also apply to IOS-XE. Can you share the output of the show process cpu history command?
There are cases in which an SNMP server is polling the switch agressively from time to time causing CPU spikes.
That can be determined by configuring a EEM script and checking the process causing those spikes:
process cpu threshold type total rising 80 interval 60 switch 1
event manager applet HIGH_CPU authorization bypass
event syslog pattern "%CPUMEM-5-RISING_THRESHOLD" maxrun 300
action 1.0 syslog msg "High CPU detected"
action 2.0 cli command "enable"
action 2.1 cli command "terminal len 0"
action 2.5 cli command "show clock | append flash:CPUlog.txt"
action 3.0 cli command "show process cpu sorted | append flash:CPUlog.txt"
action 4.0 cli command "show processes cpu detailed process iosd sort | append flash:CPUlog.txt"
action 5.0 cli command "show processes cpu detailed process fed sort | append flash:CPUlog.txt"
action 6.0 cli command "show platform punt statistics port-asic 0 cpuq -1 direction rx | append flash:CPUlog.txt"
action 7.0 cli command "show platform punt statistics port-asic 1 cpuq -1 direction rx | append flash:CPUlog.txt"
action 7.1 cli command "show snmp stats oid | append flash:CPUlog.txt"
action 8.0 cli command "show logging | append flash:CPUlog.txt"
action 8.5 cli command "terminal len 24"
action 9.0 syslog msg "HIGH_CPU EEM Script finished running"
action 9.5 cli command "end"
The previous script, supossing that you're having a standalone switch or that switch 1 in a stack is the current active unit. If not, adjust the switch id accordingly.
Once the EEM script triggers, you will need to check the contents of the generated CPUlog.txt file in flash memory.
Please let me know if you find this information useful.
In my position I can't ask to apply the script, but I'm going to see if we can lower the snmp polling for a short period and see the difference.