CPU Utilization spikes because of SNMP

edideleon · ‎10-05-2011

Hi everybody,

Please help me regarding this issue. Here is the output of sh proc cpu sorted and sh proc cpu history of our WS-4507R-E switch:

CPU utilization for five seconds: 91%/5%; one minute: 40%; five minutes: 34%

PID Runtime(ms) Invoked uSecs 5Sec 1Min 5Min TTY Process

233 304681917 308562217 987 25.43% 4.88% 2.31% 0 SNMP ENGINE

55 584412318 768493491 760 19.11% 6.48% 5.36% 0 Cat4k Mgmt LoPri

231 239737293 645600647 371 16.23% 3.12% 1.44% 0 IP SNMP

54 13709806883238751922 0 11.75% 15.95% 16.19% 0 Cat4k Mgmt HiPri

112 151778175 870249780 174 4.79% 1.43% 0.99% 0 IP Input

232 50926702 299389388 170 3.83% 0.73% 0.33% 0 PDU DISPATCHER

119 295710628 159743769 1851 2.63% 2.89% 2.90% 0 Spanning Tree

169 1668 1555 1072 0.47% 0.12% 0.16% 1 SSH Process

224 7832766 825106774 9 0.47% 0.46% 0.47% 0 HSRP Common

39 43630872 13644909 3197 0.31% 0.30% 0.31% 0 IDB Work

160 18204710 27129051 671 0.23% 0.23% 0.23% 0 CEF: IPv4 proces

61 29723343 458703736 64 0.23% 0.18% 0.16% 0 Net Input

14 34903110 68848783 506 0.23% 0.24% 0.24% 0 ARP Input

94 2077032 136439559 15 0.15% 0.15% 0.15% 0 UDLD

228 7696184 38426385 200 0.07% 0.12% 0.11% 0 PIM Process

238 245865 6797420 36 0.07% 0.00% 0.00% 0 System polling

155 8125570 42481026 191 0.07% 0.03% 0.02% 0 DHCPD Receive

229 1731910 138911719 12 0.07% 0.06% 0.07% 0 Mwheel Process

146 3347006 14782912 226 0.07% 0.02% 0.00% 0 IGMPSN

225 10747554 124967994 86 0.07% 0.06% 0.07% 0 HSRP IPv4

227 5061608 22731624 222 0.07% 0.05% 0.05% 0 IGMP Input

22 163999 13584528 12 0.00% 0.00% 0.00% 0 IPC Mcast Pendin

21 20859 2725488 7 0.00% 0.00% 0.00% 0 IPC Event Notifi

24 16 3 5333 0.00% 0.00% 0.00% 0 IPC Session Serv

23 3456 227177 15 0.00% 0.00% 0.00% 0 IPC Dynamic Cach

20 0 1 0 0.00% 0.00% 0.00% 0 IFS Agent Managev

Your help will be highly appreciated.

Thanks in advance!

Joseph W. Doherty · ‎10-05-2011

Disclaimer

The Author of this posting offers the information contained within this posting without consideration and with the reader's understanding that there's no implied or expressed suitability or fitness for any purpose. Information provided is for informational purposes only and should not be construed as rendering professional advice of any kind. Usage of this posting's information is solely at reader's own risk.

Liability Disclaimer

In no event shall Author be liable for any damages whatsoever (including, without limitation, damages for loss of use, data or profit) arising out of the use or inability to use the posting's information even if Author has been advised of the possibility of such damage.

Posting

The 4500 CPU isn't normally much involved with packet forwarding, the high CPU utilization shouldn't have much, if any, of an adverse impact. For other control plane processes that do need to share the CPU, hopefully SNMP processing would be of lower priority, and if so, shouldn't adversely impact them either.

If you want to reduce the CPU demand because of SNMP, you'll need to see what the NMS is doing. Changing the NMS to be more selective in its queries can reduce the SNMP's impact to the targeted device.

esomarriba · ‎10-05-2011

Hi Edison,

I agree with Joseph, go back to your monitoring software and check the polling settings for this particular device. I had this issue with SolarWinds and CiscoWorks, we had to set lower timers for the interval polling agents.

HTH,

/Elyinn.-

esomarriba · ‎10-05-2011

Hi Edison,

Do you have an access-list for your SNMP community string?

edideleon · ‎10-05-2011

Hello,

Yes I do have an access-list for our SNMP community string. Actually, we have a total of 2 community strings in our switch.