[c-nsp] Strange VIP CPU load

[Bill Wichers]

dCEF is running everywhere -- when that stops I can usually tell pretty
easily from the big spike in RSP CPU load.

Nothing in the process table was showing significantly more CPU than
normal, which I found very surprising.

This particular box is running 12.2(29). I will have to dig around and see
if there are any bugs that look related.

I only have to put up with this old box another maybe 6 months or so, then
it gets replaced :-)

     -Bill

> I'm assuming Distributed CEF is running.   Is your IP Input running at a
> high percentage rate?  If so I would verify that CEF is working properly
> on this VIP card.  If everything looks good there what IOS are you
> running?  There might be a possible bug and worth checking into.  Let me
> know what you find out.  ttyl
>
> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net
> [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Bill Wichers
> Sent: Thursday, January 12, 2006 9:21 PM
> To: cisco-nsp at puck.nether.net
> Subject: [c-nsp] Strange VIP CPU load
>
> I have customer running some kind of streaming app that seems to be
> using
> excessive CPU load and I'm curious if anyone knows what might cause
> this.
> Normally I only see this kind of VIP load from DoS, not from only about
> 18
> Mb/s more "legit" traffic (total on the interface was about 38-45 Mb/s
> during the "problem" period of 100% CPU load.
>
> I would expect an increase in CPU load, but not going from about 30-40%
> to
> 100% with only 18Mb/s increase in traffic, one direction (about a 30-40%
> increase in total traffic through the interface). Does anyone know what
> might cause this much CPU load for normal (i.e., not all minimum-size,
> random DoS style packets)? Below is a copy of the per-minute graph from
> 'show tech' for the VIP. Ingress side VIP only is affected, egress VIP
> is
> not showing anything abnormal, which is unlike DoS. The per-second graph
> was pretty much solidly 100% during the peaks that show on the
> per-minute
> graph.
>
> Any ideas or even wild guesses much appreciated!
>
>     -Bill
>
>
>           |- This is where I shaped the customer at the switch
>           |                                            1
>      3434449979696699899969497699999999956999966998999906795799
>      8496249969297099699936838909989999932799999998999906460599
> 100        ** * *  ** #** *     ******#*  ****  ** ***#*  *  **
>  90        ** * #  #**#** * *  *******#*  ****  ******#*  *  **
>  80        *#** #  #**#*# * ** *##*##*#*  ###*  ***#**##  * *#*
>  70        *#** #* ##*### * ***###*####*  ###***##*#*###*** *##
>  60        *#*#*#**##*###** #**######### *####**########*** *##
>  50     *  ##*#############*############*######################
>  40  *#*#######################################################
>  30  ##########################################################
>  20  ##########################################################
>  10  ##########################################################
>     0....5....1....1....2....2....3....3....4....4....5....5....
>               0    5    0    5    0    5    0    5    0    5
>
>                CPU% per minute (last 60 minutes)
>               * = maximum CPU%   # = average CPU%
>
>
>
> *****************************
> Waveform Technology
> Systems Engineer
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>


*****************************
Waveform Technology
Systems Engineer