STACK SWITCH 9200 HIGH CPU

[Pedro Javier Herrera Diaz]

Hi 

I have stack Switch with 3 Unit members with High CPU, according to the "show processes cpu" the proccess with more consumption are SISF Switcher Th and SISF Main Thread 

426 38181448 7673019 4976 35.36% 29.17% 29.11% 0 SISF Switcher Th
427 49356123 7068699 6982 49.56% 37.34% 36.96% 0 SISF Main Thread

I have some research and everyone is agree that this is because the implementation of dhcp snooping, but i need DHCP snooping operation,

Can anyone help me with other solutions besides disabled DHCP snooping o how can i find the VLAN that is causing this issue, according to some forum disabled DHCP snnoping to just one VLAN is enough.

Switch Ports Model SW Version SW Image Mode
------ ----- ----- ---------- ---------- ----
* 1 52 C9200L-48T-4X 17.03.03 CAT9K_LITE_IOSXE INSTALL
2 52 C9200L-48T-4X 17.03.03 CAT9K_LITE_IOSXE INSTALL
3 52 C9200L-48T-4X 17.03.03 CAT9K_LITE_IOSXE INSTALL

REgards

[balaji.bandi]

see if you turn off dhcp snooping is that resolve the issue ? as per the bug

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvk32439

you already in 17.3.3, may try upgrade to 17.3.4

[Leo Laohoo]

Post the complete output to the following commands: 

• sh platform software status con brief
• sh process memory platform sorted location switch active r0

[Pedro Javier Herrera Diaz]

Hi 

Attac the output of the commands

Thanks and regards

[Leo Laohoo]

CPU for switch 1 and switch 2 are a tad high but I am not concerned.  CPU for switch 3 is at a normal level. 

Can I see the output (page 1 only) for the following command:  

• sh process cpu platform sorted location switch active r0

[KalinKrumov]

Hi,

I have similar problem. Here is asked output:

Sw-C9200L#sh process cpu platform sorted location switch active r0
CPU utilization for five seconds: 10%, one minute: 19%, five minutes: 31%
Core 0: CPU utilization for five seconds: 8%, one minute: 18%, five minutes: 30%
Core 1: CPU utilization for five seconds: 8%, one minute: 18%, five minutes: 30%
Core 2: CPU utilization for five seconds: 11%, one minute: 16%, five minutes: 31%
Core 3: CPU utilization for five seconds: 9%, one minute: 16%, five minutes: 30%
Pid PPid 5Sec 1Min 5Min Status Size Name
--------------------------------------------------------------------------------
4961 4715 22% 47% 89% S 173288 linux_iosd-imag
6219 6205 9% 14% 21% S 75376 fed main event
39 2 6% 6% 6% S 0 ksmd
17557 17536 1% 1% 1% S 21024 fman_fp_image

[Leo Laohoo]

---

@KalinKrumov wrote:

4961 4715 22% 47% 89% S 173288 linux_iosd-imag

---

Oh hello there.  I have seen this before.  

What firmware is the switch on and is SNMP monitoring enabled?

Is there a DNAC appliance polling this switch?

[KalinKrumov]

Hi,

I used Nagios and Cacti for monitoring/polling not "DNAC".

The utilization rises to 100% regular for 1/2 hour by period for 2 hours period. Some services as voice calls disrupt and very slow file transfer via switch.
The problem happens when I use ver.17.6.3 in stack. One of the switches crashed and stayed in rommon mode. I disconnected the stack and now these switches operate separately connected with uplinks.

Now it is updated to ver.17.6.5 and this has not solved it.

I plan to stack them again and upgrade to some of the latest IOS.

Can you recommend a stable IOS version?

[KalinKrumov]

Yes, SNMP is enabled.

[Leo Laohoo]

CSCwd07516

[Leo Laohoo]

---

@KalinKrumov wrote:
Can you recommend a stable IOS version?

---

17.9.3

[KalinKrumov]

This has been resolved!

I upgraded to 17.9.3, stacked again, and configured all possible security features such as ip dhcp snooping, broadcast stroming, dot1x, Dynamic arp inspection, etc. Nothing about this does not change anything!

I Wiresharked all vlan by vlan and found a server which broadcast by udp. The server is a Konica Minolta printer monitoring server. The printers had been defined as IP ranges buth must be defined IP by IP. The server is scanning every hour interval and C9200L switches are overloaded to 98-100%!