[c-nsp] SNMP ENGINE consuming CPU

[John Kougoulos]

Hello,

I remember cisco boxes having CPU problems with retrieving arp / route 
table entries via SNMP more than ten years ago. Maybe someone must create 
some kind of snmp proxy that retrieves those tables from cli....

Regards,
John

On Fri, 24 Jul 2009, Jeff Fitzwater wrote:

> Hello Bill,
>
> 	How large is the ARP table?   "sho ip arp summ"   If it is around 15k 
> then the issue is the ARP or BRIDGE table conversion that the route processor 
> must do to go from hashed format to lexigraphical  format which SNMP queries 
> require.    SNMP queries the RIP table for these MIBS which are in HASHED 
> format and the FIB table is in LEX format.   There are ways around the issue 
> if you don't need to query those MIBS.
>
> 	I have had this issue with our sup-720-CXL running SXI or any earlier 
> version only on our 6500 that has a 15k arp table (not sure where the actual 
> boundary that s causes the problem is).   I currently have a case open with 
> CISCO to see if there is a fix for this.   For us there is no workaround 
> since our NMS must pole the ARP and BRIGDE tables via SNMP in order to do its 
> job.   This is extremely frustrating for us since we rely on the NMS   (HP 
> NNMi ) to build our layer 2 topo based on those MIBS,  and also TRAP 
> correlation which uses the L2 topo to isolate the problem.
>
>
> Jeff Fitzwater
> OIT Network & Communications Systems
> Princeton University
>
>
> On Jul 24, 2009, at 9:49 AM, Bill Blackford wrote:
>
>> You hit on the issue. I had a NMS client polling the route table. This box 
>> has two full feeds and 12 other bilateral peers. Apparently, the 
>> cat7.6k/rsp720 doesn't do well in this scenario. I would imagine the GSR's 
>> or perhaps even the shiny new ASR's implement this in hardware, but I am 
>> speculating since I have no stick time on those platforms. I know this 
>> wouldn't be an issue on J, but that's a topic for another list.
>> 
>> Yes, my IOS version needs updating. I'm on 12.2(33)SRB1. Any 
>> recommendations?
>> 
>> Thank you for your feedback.
>> 
>> -b
>> 
>> -----Original Message-----
>> From: Paolo Lucente [mailto:pl+list at pmacct.net]
>> Sent: Friday, July 24, 2009 2:13 AM
>> To: Bill Blackford
>> Cc: cisco-nsp mailing list
>> Subject: Re: [c-nsp] SNMP ENGINE consuming CPU
>> 
>> Hi Bill,
>> 
>> Often this is symptom that one or more NMS tools are freely walking
>> through the MIBs. Also, if you are running a recent 12.2SR train
>> image (not a recent SRD), you might be hitting the CSCsv80014 bug.
>> Btw, which IOS version are you running?
>> 
>> A good (not specific to the 7600 platform) Cisco document about SNMP
>> causing high CPU load is at the following URL:
>> 
>> http://www.cisco.com/en/US/tech/tk648/tk362/technologies_tech_note09186a00800948e6.shtml
>> 
>> It simply suggests to put in place a view to cut down some pieces of
>> the available MIBs which can easily become rather big (ie. ARP table,
>> routing table). If any of the suggested solutions work, it could be
>> a good starting point to pin-point the issue. A more final solution,
>> viable only if you are somehow in control of the SNMP pollers that
>> regularly access your routers, is to double-check who is doing what
>> and why. The tricky corner case is indeed that your SNMP poller(s)
>> are intentionally making use of some large MIB for something.
>> 
>> Cheers,
>> Paolo
>> 
>> 
>> On Thu, Jul 23, 2009 at 02:04:33PM -0700, Bill Blackford wrote:
>> 
>>> Currently I have a 7606 RSP720 hitting 94% CPU.
>>> A 'sh proc cpu sorted' indicates that SNMP ENGINE is the source.
>>> 
>>> Any thoughts on this?
>>> 
>>> Thanks
>>> 
>>> -b
>>> 
>>> --
>>> Bill Blackford
>>> Senior Network Engineer
>>> Technology Systems Group
>>> Northwest Regional ESD
>>> 
>>> my /home away from home
>> _______________________________________________
>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/