I have 2 6509-E chassis with SUP-720-VSS and classic line cards :-(. on October 2011 the switch reached 100% CPU on both devices and the entire network went down. Customer restarted the core so we lost all the log files and couldnt find out any root cause on the same. TAC engineer suggested to have some script configured on the system in case of CPU shooting up above 70%, it will create a file in flash and keep appending the logs to the same. Last week i got call from customer saying that the CPU again went high for around a minute on both the cores. Last time i added CoPP also on the switch in order to prevent the CPU reaching 100%. Still it went high and from the captured logs i saw that the process created the high CPU was Port Manager Per and SSH process. Attached the file created by the netdr capture command.
I am having issues trying to track down what is causing a high number of connection on our FWSM in our core 6509 switch. I recently upgraded my FWSM to 3.1(20) and I'm looking for a tool to be able to find the culprit. When I receive these messages I try to get onto the firewall in time to be able to get information regarding this issue but by the time I do the device recovers. Is there a way to tweat the threshold of the SNMP trap for high connections? Is there any way I can retreive this information via SNMP? Is there are command that will allow me to extract the local IP making the most connections?
From couple of weeks we have observed the cpu utilization of cisco 6509 with SUP 720 is high. During daytime from 9:00 to 21:00 it keeps increasing & reaches 98% & after 21:00 becomes normal.
We have a 6509 core with the below modules running for a long time and the utilization used to be always 10 to 13 percent checking with the supplier it was told to us that due to the firewall modue we have and its normal Now 2 days back i noticed the utilzation had jumped to 90 % and now it happened again
I see that on runnung proc cpu
16407 56.1% 56.5% 55.9% ios-base
16430 35.3% 35.2% 33.9% iprouting.iosproc
the modules present
Mod Ports Card Type Model Serial No.--- ----- -------------------------------------- ------------------ ----------- 1 6 Firewall Module WS-SVC-FWM-1 SAD140901XA 3 16 16 port 1000mb GBIC ethernet
Cisco 6509 modular IOS getting high cpu in interrupt but the switch process switching is still less. Any sugeestion what could be the problem?
Process sbin/ios-base, type IOS, PID = 16407CPU utilization for five seconds: 12%/81%; Sometimes cpu goes upto 100% Version - s72033-ipservicesk9_wan-vz.122-33.SXH5
i recently identified all switch ports in my network on 6509 core were Transmitting Mail server Exchange traffic that was destined for Unicast NLB cluster. and it was impacting various HOST machines NIC cards/performance.After reading this article, i moved NLB CAS servers behind a dedicated cisco Switch.
[URL]
Now My core switch can learn mac address across its trunk port where CAS servers are connected on dedicated switch. but still i can see traffic Transmitting out to my all switch ports of same VLAN ( same as NLB VLAN).
I have having two Cisco 6509 both working are my main Core Switches with which I have all my Layer 2 VLANs configured and then distributed thru the trunks links to all the Access Switches. I have L3- Vlans also configured on them with which one switch in primary and the other is secondary. All of sudden last night I got this message on my core switch 2 this for VLAN 1 which is my users LAN, how can I check as to what would have caused the core switch 2 HSRP to be active and then in standby
*Nov 5 23:33:29.296: %HSRP-5-STATECHANGE: Vlan1 Grp 5 state Standby -> Active *Nov 5 23:33:29.796: %HSRP-5-STATECHANGE: Vlan1 Grp 49 state Standby -> Active *Nov 5 23:33:29.804: %HSRP-5-STATECHANGE: Vlan1 Grp 49 state Active -> Speak *Nov 5 23:33:29.920: %HSRP-5-STATECHANGE: Vlan1 Grp 5 state Active -> Speak *Nov 5 23:33:40.144: %HSRP-5-STATECHANGE: Vlan1 Grp 5 state Speak -> Standby *Nov 5 23:33:41.280: %HSRP-5-STATECHANGE: Vlan1 Grp 49 state Speak -> Standby
Also last night i got call from office saying that we are getting huge delay in pinging the default gateway of the user LAN which is the same vlan as the above and it was just for few minutes and then it was back to normal and now when I came to office and check there were no logs in both the core switches. When I checked the cpu utlization it was showing me high on both the switches how can I check as to what would have caused the CPU utilisation to go high all of suddedn?
INPMHCORS01#$ sh processes cpu his 11111 11111 11111 1111111111 8885555588888666669999922222666665555511111777773333300000 100 90 80
I have a connection that is loosing packets, my show interface output below summarises the interface where i believe the problem is occuring. My Hardware is 6509 running 12.2
Today I've received reports of slow internet access/activity and have noticed myself that it seems a bit slow today. On the dashboard of our asa 5510 the "outside interface" traffic usage is running constantly high. It's at the top of the graph. How can I tell what is causing the spike in utilization. It usually runs at about 1500-2000 Kbps, and now it's up over 10,000.
We installed a solution with 2 Cisco 2801, BGP multihomed failover.
1) The router which is currently getting all the traffic gets to 55% to 60% of CPU usage when handling 40 SIP/RTP streams . This equals 10Mbit up/10Mbit down and it showed around 5800 packets TX and around 5800 packets RX, with a majority of them CEF switched. As those figures are way less than the performance figures published by Cisco, we wonder if we made any mistake in setting up our router, or if we can do something to improve the router setup.
2) Does it have an impact on router performance if we increase/decrease RTP packet size, thus increasing or decreasing the pps relative to the consumed bandwidth?
3) If it is not possible to improve router configuration, we also wonder about possible replacement units for those routers. Would a 2901 do a good job? By how much would it rise the capacity? What other models would you recommend if we plan to rise the number of concurrent calls by a factor of 4 or even 8 times of what we have now (so up to 48000 pps and 80Mbit).
Here is what we tried:
- ip route-cache same-interface does not seem to improve anything
- ip flow ingress on or off makes no difference
- disabling the inbound ACL on fa0/0 seems to reduce load by 10%, although I don't understand why - a very high percentage is CPU interrupts, and ACLs are process switched, or not?
- we tried following the Cisco guide for high CPU due to high interrupts, with no success
Here are some usage statistics:
The graphs that we plot via SNMP show a propotional growth/increase of CPU and bandwidth (and thus pps) At the highest loads, we had a bit more than 55% CPU utilization with more than 50% interrupt CPU.
CPU utilization for five seconds: 36%/30%; one minute: 30%; five minutes: 30% PID Runtime(ms) Invoked uSecs 5Sec 1Min 5Min TTY Process 127 13140 954 13773 2.00% 0.29% 0.07% 194 SSH Process
I currently have a couple of 6509 chassis (router/switches) with the following hardware blades:
x3 48 ports x1 NAM x2 Sup720 Running 12.2(18)SXF3
I am keeping the four Sup720 modules and have purchased new versions of the others blades including two new 6509-E chassis?Can I take my stand-by Sup720 out of the production machine and insert it into the new chassis?
I currently have a couple of 6509 chassis (router/switches) with the following hardware blades:
x3 48 ports x1 NAM x2 Sup720
Running 12.2(18)SXF3.I am keeping the four Sup720 modules and have purchased new versions of the others blades including two new 6509-E chassis. Can I take my stand-by Sup720 out of the production machine and insert it into the new chassis?
CPU utilization for five seconds: 61%/59%; one minute: 62%; five minutes: 63% PID Runtime(ms) Invoked uSecs 5Sec 1Min 5Min TTY Process 578 5856 9392486 0 0.55% 0.50% 0.50% 0 IP SLAs XOS Even 231 90364 576908
When a physical switchport/routed port has high usage, you can move the link to a higher capacity port, upgrade the port, bond links, etc. What exactly do you do when an SVI has high usage? I guess you could remove some servers from the VLAN, but that doesn't seem like a reasonable solution. What dictates the capacity of an SVI? The backplane of the switch?
I always test ethernet family links(E, Fa, Gi) sending pings with MTU equal to 1500. Since most hosts uses MTU 1500 I think is not necessary to test using a high MTU size like 18024.
Our Router 7606 is in a problem with high CPU Utilization. We are using one EBGP and one IBGP session. We are also running OSPF with area 0 between two IBGP router to exchange few local networks. When bandwidth cross 100 MB than only CPU use become 100%. when bandwidth consumption is 80MB CPU use become 80% end so on.
Out put is when bandwidth consumption is 34MB
CPU utilization for five seconds: 44%/43%; one minute: 42%; five minutes: 30% PID Runtime(ms) Invoked uSecs 5Sec 1Min 5Min TTY Process 78 44 9625 4 0.39% 0.03% 0.00% 2 Virtual Exec 13 40 375 106 0.07% 0.00% 0.00% 0 ARP Input 30 116 1098 105 0.07% 0.01% 0.00% 0 IPC Seat Manager
I have a hight CPU utilisation problem in my CISCO7609-S routers. the cpu utilisation can rise 99% et this is usually. In the moment of hight CPU the the process CPU give the following:
I have a 1841 router plugged into a 100M Comcast ethernet connection. My router cpu is really high and users download speed isn't as high as before. Can a 1841 handle 100M circuit with 100 users on it? What would cause the router's cpu to be high? I don't think there are any viruses or malware on the lan.
#sh proc cpu his r2.leaguecity-toy-startoy 06:06:26 PM Wednesday May 30 2012 PST 111 1 1 1 111 24 1 1 1 1 400369232222544222330359645223283294332688334452308404382236
I've noticed a strange behaviour in my 2960s regarded to CPU.
CPU level is very high, 70-75% when nobody is logged by vty or console, but it drops drastically to 40% when sombebody logs in. I've been able to discover that this is due to CPU interrupt level, as it shows the output of sh process cpu sort 5sec, just logged in.
RH0A01-SW1-10G#sh proces cpu sorted 5sec CPU utilization for five seconds: 68%/37%; one minute: 67%; five minutes: 50%
...Some seconds after logged in...
RH0A01-SW1-10G#sh proces cpu sorted 5sec CPU utilization for five seconds: 35%/11%; one minute: 52%; five minutes: 48%
I have a 2811 that is really hitting the CPU hard. Nothing shows on CPU processes. It has an IPsec VPN tunnel back to HQ which also has a 2811 that terminates the VPN. The HQ has 2-3 IPsec tunnels to other remote sites. The CPU at the HQ avg 50% utilization during business hrs, peaks at about 80%. The remote one is very high 95% peaks, avg 80%-95% during business hours with bandwidth utilization of only 10-20Mbps. I read somewhere that its possible that fragmentation could be causing this. My question is, if I set the MTU to 1450 on the remote, I am guessing I will need to do all the other routers as well, the HQ and other remote sites? Siince they use the same outside interface to my HQ, is that correct?
how to resolve high cpu to interrupt.I am getting lots of input que drops in all vlan interfaces.I have enabled multicast in all vlan interfaces. System image file is "sup-bootdisk:s72033-advipservicesk9_wan-mz.122-33.SXI4a.bin"
A customer reported that their router experienced spikes (high cpu utilization) every 4 hours and claims that it is caused by snmp polling of the Ciscoworks server.
The process SNMP engine is the process that causes these spikes .We think that the job responsible of this periodic high CPU utilization. It's called "Vrf Collector Job" and it's runnning every 4 hours.Below the result of show stack PID and show version
*Sep 5 12:02:43.230 GMT+1: %SYS-1-CPURISINGTHRESHOLD: Threshold: Total CPU Utilization(Total/Intr): 56%/14%, Top 3 processes(Pid/Util): 557/39%, 488/1%, 555/0% *Sep 5 12:02:43.286 GMT+1: %HA_EM-4-LOG: CPUTH: Process 557: SNMP ENGINE Stack segment 0x1CFC204C - 0x1CFC4F2C
I am observing very high CPU utilization on my Cisco 7206VXR (NPE-G1) Router. We have done all the necessary troubleshooting but not able to identify root cause. [code]
