question regarding CPU processes

[Russell Gibbons]

How can I figure out where all my CPU is going? I get that the sum of the processes are off from the total of 93%, but they are SO off that I don't know where to start. Are any of these individual uses unreasonably high?

TIA,

Russell

sh proc cpu | ex 0.00%  0.00%  0.00%
CPU utilization for five seconds: 93%/90%; one minute: 92%; five minutes: 90%
 PID Runtime(ms)     Invoked      uSecs   5Sec   1Min   5Min TTY Process
   2      165644      611705        270  0.23%  0.26%  0.38%   0 Load Meter
   3        4904         238      20605  0.15%  0.11%  0.05% 706 SSH Process
   6     3437192      478192       7187  0.00%  0.08%  0.06%   0 Check heaps
  27       77256      611382        126  0.00%  0.01%  0.00%   0 Environmental mo
  47     2631536      784005       3356  0.07%  0.08%  0.07%   0 Net Background
  87     1766716     3054784        578  0.07%  0.04%  0.03%   0 tCOUNTER
 102     1322988   386699797          3  0.47%  0.28%  0.24%   0 Ethernet Msec Ti
 113     1216876     5894881        206  0.07%  0.02%  0.00%   0 ADJ resolve proc
 117      223856    94759063          2  0.07%  0.03%  0.02%   0 IPAM Manager
 121     2178188    13288888        163  0.07%  0.07%  0.07%   0 IP Input
 136       39936    11936822          3  0.07%  0.00%  0.00%   0 SSS Feature Time
 PID Runtime(ms)     Invoked      uSecs   5Sec   1Min   5Min TTY Process
 152      159628     3617101         44  0.00%  0.04%  0.01%   0 CEF: IPv4 proces
 200      349552       51026       6850  0.00%  0.01%  0.00%   0 BGP Scanner
 209        1160        1709        678  0.07%  0.00%  0.00%   0 TPLUS
 286      841376       51994      16182  0.00%  0.01%  0.00%   0 Per-minute Jobs
 287    42427460     3063299      13850  1.43%  1.47%  1.36%   0 Per-Second Jobs
 295      918484   189478944          4  0.15%  0.18%  0.15%   0 HSRP Common
 296      174832     2479530         70  0.00%  0.01%  0.00%   0 HSRP IPv4
 303     1030324      873475       1179  0.00%  0.01%  0.00%   0 SNMP ENGINE

[Joseph W. Doherty]

Disclaimer

The Author of this posting offers the information contained within this posting without consideration and with the reader's understanding that there's no implied or expressed suitability or fitness for any purpose. Information provided is for informational purposes only and should not be construed as rendering professional advice of any kind. Usage of this posting's information is solely at reader's own risk.

Liability Disclaimer

In no event shall Author be liable for any damages whatsoever (including, without limitation, damages for loss of use, data or profit) arising out of the use or inability to use the posting's information even if Author has been advised of the possibility of such damage.

Posting

Most of your CPU is being used by the interrupt process; which generally is optimal packet forwarding routines.

[aacole]

What type of device is this taken from?

It does look odd, you have 93% total CPU, of which 90% is interrupt based. I'm surprised that the value for the IP Input % is so low, I agree with Joseph's comment, and if this was true the IP input value would be approaching the interrupt value, at least on the switches I'm dealing with.

[Joseph W. Doherty]

Disclaimer

The Author of this posting offers the information contained within this posting without consideration and with the reader's understanding that there's no implied or expressed suitability or fitness for any purpose. Information provided is for informational purposes only and should not be construed as rendering professional advice of any kind. Usage of this posting's information is solely at reader's own risk.

Liability Disclaimer

In no event shall Author be liable for any damages whatsoever (including, without limitation, damages for loss of use, data or profit) arising out of the use or inability to use the posting's information even if Author has been advised of the possibility of such damage.

Posting

Yes, you might see that on a L3 switch which does fast path forwarding in (ASIC) hardware, but on a (true/small) router (which I'm guessing this is), fast path forwarding is done on main CPU.  I've often seen stats like this on such routers.

[Russell Gibbons]

the device in question is a 3845.

Cisco 3845 (revision 1.0) with 485376K/38912K bytes of memory.
Processor board ID FTX1519AJZN
16 FastEthernet interfaces
2 Gigabit Ethernet interfaces
DRAM configuration is 64 bits wide with parity enabled.
447K bytes of NVRAM.
126000K bytes of ATA System CompactFlash (Read/Write)

System image file is "flash:c3845-spservicesk9-mz.151-1.T2.bin"

[Russell Gibbons]

Am I just pushing too much traffic through a 3845? I have a 250Mb internet circuit on it, and a very small routing table:

Gateway of last resort is a.b.89.213 to network 0.0.0.0

B*    0.0.0.0/0 [20/0] via a.b.89.213, 5w0d
      10.0.0.0/8 is variably subnetted, 3 subnets, 3 masks
S        10.0.0.0/8 [1/0] via 10.45.0.1
C        10.45.0.0/24 is directly connected, FastEthernet1/0
L        10.45.0.4/32 is directly connected, FastEthernet1/0
      12.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C        a.b.89.212/30 is directly connected, GigabitEthernet0/0.1
L        a.b.89.214/32 is directly connected, GigabitEthernet0/0.1
      63.0.0.0/8 is variably subnetted, 5 subnets, 3 masks
S        x.y.126.0/24 is directly connected, Null0
C        x.y.126.0/25 is directly connected, GigabitEthernet0/1
L        x.y.126.4/32 is directly connected, GigabitEthernet0/1
C        x.y.126.128/25 is directly connected, FastEthernet1/1
L        x.y.126.132/32 is directly connected, FastEthernet1/1
S     172.16.0.0/12 [1/0] via 10.45.0.1
S     192.168.0.0/16 [1/0] via 10.45.0.1

[Joseph W. Doherty]

Disclaimer

The Author of this posting offers the information contained within this posting without consideration and with the reader's understanding that there's no implied or expressed suitability or fitness for any purpose. Information provided is for informational purposes only and should not be construed as rendering professional advice of any kind. Usage of this posting's information is solely at reader's own risk.

Liability Disclaimer

In no event shall Author be liable for any damages whatsoever (including, without limitation, damages for loss of use, data or profit) arising out of the use or inability to use the posting's information even if Author has been advised of the possibility of such damage.

Posting

Too much traffic, at 250 Mbps?  Yes, it may be.

3845 is recommended, by Cisco, for up to 45 Mbps.

My experience is they can handle up to about 100 Mbps.

[Russell Gibbons]

why would a device that can only handle 45-100Mbps have 2 Gb ports on it though? Just to taunt me?

[Joseph W. Doherty]

Disclaimer

The Author of this posting offers the information contained within this posting without consideration and with the reader's understanding that there's no implied or expressed suitability or fitness for any purpose. Information provided is for informational purposes only and should not be construed as rendering professional advice of any kind. Usage of this posting's information is solely at reader's own risk.

Liability Disclaimer

In no event shall Author be liable for any damages whatsoever (including, without limitation, damages for loss of use, data or profit) arising out of the use or inability to use the posting's information even if Author has been advised of the possibility of such damage.

Posting

Laugh - you've figured out the "secret".

ISRs are WAN routers not LAN routers, so they often do not have forwarding performance to support their LAN ports at full capacity.

Why they actually do that, is only known to Cisco marketing, but I suspect it's considered a sales feature.