[c-nsp] CEF Scanner eating CPU in Supervisor 720

[Peter Salanki]

The CEF Scanner is now eating almost all CPU :/

The events table doesn't look any particular to me,
--SNAP--

+00:00:00.000:           81.170.148.226/32     ADJ (Vl4001) update     
[OK]
+00:00:00.024:           195.178.160.138/32    ADJ (Vl19) update       
[OK]
+00:00:00.052:           81.170.138.13/32      ADJ (Vl604) update      
[OK]
+00:00:00.232:           81.170.152.129/32     ADJ (Vl4003) update     
[OK]
+00:00:00.240:           81.170.148.118/32     ADJ (Vl4001) update     
[OK]
+00:00:00.304:           81.170.149.246/32     ADJ (Vl4001) update     
[OK]
+00:00:00.320:           81.170.152.50/32      ADJ (Vl4003) update     
[OK]
+00:00:00.380:           81.170.154.117/32     ADJ (Vl4004) update     
[OK]
+00:00:00.388:           213.136.56.90/32      ADJ (Vl39) update       
[OK]
+00:00:00.400:           81.170.136.79/32      ADJ (Vl504) update      
[OK]
+00:00:00.416:           195.178.160.173/32    ADJ (Vl19) update       
[OK]
+00:00:00.512:           81.170.164.163/32     ADJ (Vl4009) update     
[OK]
+00:00:00.728:           81.170.130.75/32      ADJ (Vl204) update      
[OK]
+00:00:00.736: [Default] 199.3.108.0/24        NBD modified            
[OK]
+00:00:00.736: [Default] 199.3.109.0/24        NBD modified            
[OK]
+00:00:00.820:           195.178.186.24/32     ADJ (Vl666) update      
[OK]
+00:00:00.832:           81.170.160.3/32       ADJ (Vl4007) update     
[OK]
+00:00:00.868:           81.170.164.33/32      ADJ (Vl4009) update     
[OK]
+00:00:00.944:           81.170.132.159/32     ADJ (Vl304) update      
[OK]
+00:00:00.952:           81.170.128.77/32      ADJ (Vl104) update      
[OK]
+00:00:01.008:           81.170.149.246/32     ADJ (Vl4001) update     
[OK]
+00:00:01.128:           194.68.123.141/32     ADJ (Vl15) update       
[OK]
--More--


8 jun 2006 kl. 19.40 skrev Rodney Dunn:

> Are you running MPLS on the box?
>
> Check the sh ip cef event outut and see if you have a /32 ADJ
> for a mac constantly changing. That's the most common trigger
> I've seen for the scanner running high.
>
> You are forcing CEF to constantly reresolve prefixes.
>
> Rodney
>
> On Thu, Jun 08, 2006 at 02:23:22PM +0200, Peter Salanki wrote:
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA1
>>
>> Hello,
>>
>> Process "CEF Scanner" is eating average 60% of the CPU on one of my
>> Sup720-3BXL. This leads to snmp responses being delayed and full BGP
>> updates taking a long time. I have not seen this on any of my other
>> sup720s. What differs this box from the rest is that this one has a
>> lot of directly connected hosts ~10 SVIs with 300 hosts each (on /23
>> subnets). I have tried setting arp timeout to 1200 on those SVIs,
>> which resulted in a small CPU utilization decrease. What can I do to
>> calm down the CEF Scanner? I'm running 12.2(18)SXF4.
>>
>> CPU utilization for five seconds: 44%/4%; one minute: 38%; five
>> minutes: 38%
>> PID Runtime(ms)   Invoked      uSecs   5Sec   1Min   5Min TTY Process
>> 119   103495040    719635     143819 35.40% 23.87% 21.54%   0 CEF
>> Scanner
>>
>> Sincerely
>>
>> Peter Salanki
>> Chief Network Engineer
>> Bahnhof AB (AS8473)
>> www.bahnhof.se
>> Office: +46855577132
>> Cell: +46709174932
>>
>>
>> -----BEGIN PGP SIGNATURE-----
>> Version: GnuPG v1.4.2.2 (Darwin)
>>
>> iD8DBQFEiBa7iQKhdiFGiogRAr9aAJ9W+rryMPcg5qnAYrYTU9jbRg8PFgCdHDA3
>> QjIpm/Yk7kuf4VjZN5MqDq8=
>> =O029
>> -----END PGP SIGNATURE-----
>> _______________________________________________
>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>> archive at http://puck.nether.net/pipermail/cisco-nsp/

Med vänliga hälsningar

Peter Salanki
Nätansvarig
Bahnhof AB (AS8473)
www.bahnhof.se
Kontor: +46855577132
Mobil: +46709174932