Content

| 3.4 |  | Identifying Physical Layer Problems |
| 3.4.8 |  | CPU overload |

The following list describes common symptoms of high CPU utilization. If any of these symptoms are noticed, follow the troubleshooting steps below to alleviate the problem.

- High percentages in the show processes cpu command output
- Input queue drops
- Slow performance
- Services on the router fail to respond, for instance:

> 1. Slow response in Telnet or unable to telnet to the router
> 2. Slow or no response to ping
> 3. Router does not send routing updates

The output of a show processes cpu command from a Cisco device, can be used by Output Interpreter to display potential issues and fixes.

The show processes cpu command can be used to check if CPU utilization is high due to interrupts. If it is not, check which process is loading the CPU.

The main cause of CPU interrupts is the fast switching of traffic. Interrupts are also generated any time a character is output from the console or auxiliary ports of a router. However, Universal Asynchronous Receiver/Transmitters (UARTs) are slow, compared to the processing speed of the router, so it is not likely that console or auxiliary interrupts can cause a high CPU utilization on the router.

There are several reasons for high CPU utilization due to interrupts:

- Voice ports are configured on the router, even if there is no traffic, software continues to monitor channel associated signaling (CAS).
- There are active Asynchronous Transfer Mode (ATM) interfaces on the router, the ATM interfaces continually send out null cells (per ATM standards) and continue to use CPU resources.
- An inappropriate switching path is configured on the router.
- The CPU is performing memory alignment corrections, if %ALIGN-3-CORRECT messages are logged, then the high CPU utilization is caused by memory alignment corrections, which indicates that bugs in the version of the Cisco IOS used.

If the router is overloaded with traffic, the show interfaces and show interfaces switching commands provide information about which interfaces are overloaded.

Output of the show interfaces command can be used to examine the load and number of throttles on interfaces. Throttles are a good indication of an overloaded router. They show the number of times the receiver on the port has been disabled, possibly due to buffer or processor overload. Together with high CPU utilization on an interrupt level, throttles indicate that the router is overloaded with traffic.

Output from the show interfaces switching command can be used to see what kind of traffic, protocol, and switching path, is going through the overloaded interface. If some interfaces are too overloaded with traffic, consider redesigning the traffic flow in the network or upgrading the hardware.

A single device may be generating packets at an extremely high rate and overloading the router. In this case the Media Access Control (MAC) address of that device can be isolated by adding the ip accounting mac-address {input|output} interface configuration command to the configuration of the overloaded interface. The show interfaces [type number] mac-accounting or show interfaces mac commands display the collected information. Once the source device's MAC address is found, the corresponding IP address can be found by checking the output of the show arp privileged exec command.

A last possibility is that there might be a bug in the Cisco IOS Software version running on the device. Once all the previous steps in this list have been performed, check the Bug Navigator, registered customers only, for a bug that reports similar symptoms in a similar environment.