[c-nsp] SNMP ENGINE consuming CPU

[Jeff Fitzwater]

Hello Bill,

	How large is the ARP table?   "sho ip arp summ"   If it is around 15k  
then the issue is the ARP or BRIDGE table conversion that the route  
processor must do to go from hashed format to lexigraphical  format  
which SNMP queries require.    SNMP queries the RIP table for these  
MIBS which are in HASHED format and the FIB table is in LEX format.    
There are ways around the issue if you don't need to query those MIBS.

	I have had this issue with our sup-720-CXL running SXI or any earlier  
version only on our 6500 that has a 15k arp table (not sure where the  
actual boundary that s causes the problem is).   I currently have a  
case open with CISCO to see if there is a fix for this.   For us there  
is no workaround since our NMS must pole the ARP and BRIGDE tables via  
SNMP in order to do its job.   This is extremely frustrating for us  
since we rely on the NMS   (HP NNMi ) to build our layer 2 topo based  
on those MIBS,  and also TRAP correlation which uses the L2 topo to  
isolate the problem.


Jeff Fitzwater
OIT Network & Communications Systems
Princeton University


On Jul 24, 2009, at 9:49 AM, Bill Blackford wrote:

> You hit on the issue. I had a NMS client polling the route table.  
> This box has two full feeds and 12 other bilateral peers.  
> Apparently, the cat7.6k/rsp720 doesn't do well in this scenario. I  
> would imagine the GSR's or perhaps even the shiny new ASR's  
> implement this in hardware, but I am speculating since I have no  
> stick time on those platforms. I know this wouldn't be an issue on  
> J, but that's a topic for another list.
>
> Yes, my IOS version needs updating. I'm on 12.2(33)SRB1. Any  
> recommendations?
>
> Thank you for your feedback.
>
> -b
>
> -----Original Message-----
> From: Paolo Lucente [mailto:pl+list at pmacct.net]
> Sent: Friday, July 24, 2009 2:13 AM
> To: Bill Blackford
> Cc: cisco-nsp mailing list
> Subject: Re: [c-nsp] SNMP ENGINE consuming CPU
>
> Hi Bill,
>
> Often this is symptom that one or more NMS tools are freely walking
> through the MIBs. Also, if you are running a recent 12.2SR train
> image (not a recent SRD), you might be hitting the CSCsv80014 bug.
> Btw, which IOS version are you running?
>
> A good (not specific to the 7600 platform) Cisco document about SNMP
> causing high CPU load is at the following URL:
>
> http://www.cisco.com/en/US/tech/tk648/tk362/technologies_tech_note09186a00800948e6.shtml
>
> It simply suggests to put in place a view to cut down some pieces of
> the available MIBs which can easily become rather big (ie. ARP table,
> routing table). If any of the suggested solutions work, it could be
> a good starting point to pin-point the issue. A more final solution,
> viable only if you are somehow in control of the SNMP pollers that
> regularly access your routers, is to double-check who is doing what
> and why. The tricky corner case is indeed that your SNMP poller(s)
> are intentionally making use of some large MIB for something.
>
> Cheers,
> Paolo
>
>
> On Thu, Jul 23, 2009 at 02:04:33PM -0700, Bill Blackford wrote:
>
>> Currently I have a 7606 RSP720 hitting 94% CPU.
>> A 'sh proc cpu sorted' indicates that SNMP ENGINE is the source.
>>
>> Any thoughts on this?
>>
>> Thanks
>>
>> -b
>>
>> --
>> Bill Blackford
>> Senior Network Engineer
>> Technology Systems Group
>> Northwest Regional ESD
>>
>> my /home away from home
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/