[nsp] Re: CEF scanner eating all CPU

[Siva Valliappan]

Hi Jon,

   the CEF Scanner process usually runs when it needs to compute a
new L2 adjacency because of a MAC rewrite or something along those
lines.  so things to look at is if you have something that is
constantly changing your L2 address for a link/address/etc.  e.g.
do you have a default route?  is it pointed at an ip address that
is constantly changing MAC addresses, etc.

you might want to configure

conf t
 ip cef table event-log
end

and then issue a

"show ip cef event"
"show ip cef event detail"

it might possibly be CSCdz59236.  but hard to tell without some
indepth troubleshooting.  you may want to consider opening a TAC
case so that a TAC engineer can work with you in running CPU profiling
to see what the CEF Scanner process is actually doing.  this will
help us figure out if this is a known issue or something new.

cheers
.siva

On Tue, 22 Jul 2003 jlewis at lewis.org wrote:

> On Mon, 21 Jul 2003 jlewis at lewis.org wrote:
>
> > I upgraded several 3640 DSL agg routers last night from
> > c3640-js-mz.122-12.bin to c3640-js-mz.122-17a.bin.  Configs are all fairly
> > similar...T1 IMA cards taking ATM T1's from the ILEC for mostly PPPoA DSL
> > customers, some of the routers have some bridged DSL customers as well.
> > All are MPLS VPN PE routers and use BGP to exchange vrf routes.
> >
> > One particular router has CEF scanner eating all available CPU time.
> > After the upgrade, CPU utilization shot up from about 15% to 99%, stayed
> > there for about 8 hours, dropped to normal levels (15-20%) for 4 hours,
> > then shot back up to 99%.
>
> We just had another 3640 DSL agg router do this.  This one had run
> normally for about 24h after the upgrade (from 12.2(16) to 12.2(17a)),
> then the CPU load shot up to 99% and the router became very unresponsive.
> A coworker got to it and dealt with it (reload) without looking at show
> proc, so I don't know for sure that it was CEF scanner again.  So, now out
> of about a dozen units, we've had two freak out CPU load-wise shortly
> after this upgrade.
>
> I'm beginning to consider other versions.  It looks like I could move to
> 12.3.1 or maybe 12.3.1a and not lose any features I need.
>
> Anyone else using 12.3 on 3640's with T1-IMA for DSL?  Is it generally
> working for you?
>
> ----------------------------------------------------------------------
>  Jon Lewis *jlewis at lewis.org*|  I route
>  System Administrator        |  therefore you are
>  Atlantic Net                |
> _________ http://www.lewis.org/~jlewis/pgp for PGP public key_________
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> http://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>