Hello together,
I have a Virtual Chassis consisting of 4 OS6860E-P48 running software version 8.10.102.R01. Since approximately 1 week I have seen the VC reporting that the CPU is over threshold, but not constantly. According to my OV2500 data, the VC is almost constantly running at 85% CPU (default threshold is 80%), but there are phases where it falls down to under 40%. There were't any changes made to the configuration, so I am quite unsure where this behavior comes from. The configuration itself is also not that complex as to really use that much CPU: We have several VLANs (but VLAN Routing is done through an external firewall, not on the switch), UNP is configured on several ports (as replacement for mobile ports for our phones) and Port-Security on those UNP Ports.
But like I wrote, this configuration has not changed in the last weeks, so I don't think this should impact the CPU that heavily.
Can anyone give me a pointer how to investigate/troubleshoot this further?
Thanks in advance.
How to investigate CPU over threshold event?
Re: How to investigate CPU over threshold event?
Hi Daniel,
mostly the reason for high cpu is more (unwanted) multicast in the network.
But it will difficult to find the source.
You can check with "su" and "top -b | head -n 9" - there you see the 5 processes with the highest cpu usage.
You can limitate the mc traffic in generally (flood limit). And to find the source of the mc traffic you can use wireshark.
Or (if possible) you find out the incomming port.
"show interface counters" or by checking the cpu with disabled ports.....
Hope you will find the source.
BR Silvio
mostly the reason for high cpu is more (unwanted) multicast in the network.
But it will difficult to find the source.
You can check with "su" and "top -b | head -n 9" - there you see the 5 processes with the highest cpu usage.
You can limitate the mc traffic in generally (flood limit). And to find the source of the mc traffic you can use wireshark.
Or (if possible) you find out the incomming port.
"show interface counters" or by checking the cpu with disabled ports.....
Hope you will find the source.
BR Silvio
Re: How to investigate CPU over threshold event?
Hi Silvio,
thanks for the response. I will try the commands, when this occurs again and I catch it. The thing which makes this curious is the fact that nothing really changed in our infrastructure. There were no new network devices added and nothing changed in the config. Multicast flood limit is already configured to 10 mbps on most ports.
Interestingly, this also only happens in the evening/night. According to the OV2500 charts this regularly happens between 5pm and 6am, which is even more curious, but only since last week.
thanks for the response. I will try the commands, when this occurs again and I catch it. The thing which makes this curious is the fact that nothing really changed in our infrastructure. There were no new network devices added and nothing changed in the config. Multicast flood limit is already configured to 10 mbps on most ports.
Interestingly, this also only happens in the evening/night. According to the OV2500 charts this regularly happens between 5pm and 6am, which is even more curious, but only since last week.
Re: How to investigate CPU over threshold event?
At my last customer with this issue it occoures after a software update of special devices some weeks ago.
To located this devices as reason I have searched in some TB of pcap files.
BR Silvio
To located this devices as reason I have searched in some TB of pcap files.
BR Silvio
