High Processor Rates on Routers.

Fri Nov 8 04:27:39 UTC 2002

I have seen similar behavior like this, on various platforms (3640, 7206 and
7513) when using PBR (Policy Based Routing) on an interface looking at
source IP's to make a routing decision.  The BGP SCANNER process jumps up to
99% for a second or 2 every 60 seconds.  After taking out the POLICY MAP's
on the appropriate interfaces, the BGP SCANNER processes never jump up
again.

I never really found out why this happened from Cisco, TAC stated that most
routers do not have specialized ASIC's to handle PBR, and so it is handled
like a generic CPU process, and if your BGP table is large, and it has to
walk the BGP TABLE often (if you receive large amounts of updates etc...),
and PBR is enabled, weird things happen...

Hope this helps...

-Aaron

-----Original Message-----
From: owner-nanog at merit.edu [mailto:owner-nanog at merit.edu]On Behalf Of
Chris Roberts
Sent: Wednesday, November 06, 2002 8:54 AM
To: internetguy205 at hotmail.com
Cc: nanog at merit.edu; headguy at techies.com
Subject: Re: High Processor Rates on Routers.

On Wed, Nov 06, 2002 at 08:21:39AM -0500, internetguy205 at hotmail.com wrote:
>
>
> Ladies & Gentleman.
>
>
> Was wondering if it is common for processor rates on higher end Crisco
boxes to race from 1 or 2 % show on the 5 second processor rate interval, to
anywhere from 70 to 90 %, instanteously, then drop back down to 1 or 2 %
after 10 seconds.
>
>

Check out for down interfaces, Serial/POS on the router. I've seen this
cause these spikes (although not normal for 10 seconds, more normally
about a second or so) every 30 seconds and make sure they're shut down.

Also check out OSPF to see if there is an interface flapping somewhere
in your network with the undocumented command 'sh ip ospf stat', which
will tell you what OSPF is doing, and look for a correlation between
the delta times and your high CPU utilisation.

BGP can cause a lot of processor utilisation when updates are received,
although this is not normally at accurate 30 second intervals, so I
wouldn't suspect this particularly.

Cheers,
--
|=========-----             -------=======|
|  Chris Roberts (croberts at bongle.co.uk)  |
|=======-------             -----=========|