Router Random high cpu spike - with LMS

[secureIT]

Hi Cisco experts,

I am having a cisco 7609-S router with the image sup-bootdisk:c7600rsp72043-ADVIPSERVICESK9-mz.122-33.SRD7.bin. Im getting above 95% cpu spike for 10 mins in every 2hrs of interval, after it has been integrated with Ciscoworks LMS version 3.2.1 and added this to HUM. In LMS the HUM polling has been configured for every 1hr to monitor the cpu and memory utilization.

I have gone through the below cisco document and I have configured all of the snmp-server view commands as illustrated in the below website.

http://www.cisco.com/en/US/tech/tk648/tk362/technologies_tech_note09186a00800948e6.shtml

https://supportforums.cisco.com/thread/2045693

After configuring the same, now we are observing the cpu spike every 4 hrs or i would say 5 hrs... I have checked all the settings of ciscoworks LMS and there is absolutely no other jobs are running in the day time... The spike comes every 4 hrs.

I have attached the LMS version details in this case...

regards()

sec-team

[rsimoni]

Hi,

can you print a show process cpu sorted at the time you see high cpu?

Riccardo

[secureIT]

We ran this command and checked in show logging and identified that the process which is consuming cpu is snmpengine.

[rsimoni]

Hi Rajesh,

there are few bugs related to LMS polling wrong MIB causing high cpu on 7600 and Cat6500.

It is important to say that the cpu protection mechanism of this platform prevent low priority processes such as SNMP from creating a real damage to the box. If more important processes need cpu cycles the scheduler will make sure that snmp release them; also snmp related traffic goes into a specific queue on its way to the RP; beyond a certain limit it is dropped. Last but not least this platform performs forwarding in hardware so even when the cpu is at 100% it can perform its forwarding tasks w/o any issue.

Moreover, under ALL circumastances, CPU spikes are NOT an issue. CPU problems are those when the CPU is constanly under high load for prolonged time. Process such bgp scanner (to name one among others) are know to cause those spikes.

That to say that even if you leave your device like this nothing will happen.

However if you want to go deep into this, you will find out that many similar bugs cover the area.

for instance "CSCsl78965    High CPU in SNMP engine, mplsVpnVrfRouteEntry " might be a good candidate.

You might want to try and see if this is the one by applying the workaround suggested which is to add this line on the 7600

snmp-server view mplsVpnVrfRouteEntry excluded

(viewname is the community used by LMS).

Another approach might be upgrading both IOS and LMS to later versions, as many other defetcs have been fixed along the way.

Last note is that if you intend to go further you need to open a TAC case as this type of investigation cannot be done on the forum. Try my suggestion first if it does not help go for a TAC case.

regards,

Riccardo