2611 CPU vs. Memory

[bshady]

I have two Cisco 2611's connected to full T-1s and I am having CPU problems! My cpu's are both pretty much stuck at 80+ precent. The same routers are only using 9 of 32MB memory. I do have pretty specific ACLs in place (in and out). Can I specify the ACLs to use memory? Any suggestions would be greatly appreciated!

Thanks!

 

[LiNuXGuRL]

of course they can! when you do sho cpu processes what process uses up the most resources.

excessive acls are also causing performance lacks like slow response, cause the router has to look thru the entire acl when processing in/outgoing packet. that not only slows down the router but also the line speed. try to streamline your acls or think about investing into a firewall.

 

[bshady]

Thansk for your response... Basically, anything IP is consuming all the resources. What would you suggest?

Thanks!

 

[LiNuXGuRL]

can u post the output of show cpu processes here?

 

[bshady]

Per your request:

CPU utilization for five seconds: 75%/66%; one minute: 77%; five minutes: 77%
PID Runtime(ms) Invoked uSecs 5Sec 1Min 5Min TTY Process
1 1615536 1024320 1577 0.00% 0.00% 0.00% 0 Load Meter
2 348 122 2852 0.48% 0.19% 0.05% 66 Virtual Exec
3 52735265 527293 100013 0.00% 0.48% 0.50% 0 Check heaps
4 11451267 174574 65596 0.00% 0.00% 0.00% 0 Pool Manager
5 0 2 0 0.00% 0.00% 0.00% 0 Timers
6 4 17 235 0.00% 0.00% 0.00% 0 Serial Background
7 105453 172056 612 0.00% 0.00% 0.00% 0 Environmental monito
r
8 737611 366143 2014 0.00% 0.00% 0.00% 0 ARP Input
9 0 5 0 0.00% 0.00% 0.00% 0 DDR Timers
10 0 1 0 0.00% 0.00% 0.00% 0 SERIAL A'detect
11 0 6 0 0.00% 0.00% 0.00% 0 Service-module alarm
handler
12 1064636240 419738133 2536 7.34% 7.34% 6.89% 0 IP Input
13 542408 552956 980 0.00% 0.00% 0.00% 0 CDP Protocol
14 0 1 0 0.00% 0.00% 0.00% 0 Asy FS Helper
15 0 1 0 0.00% 0.00% 0.00% 0 PERUSER aux
16 0 1 0 0.00% 0.00% 0.00% 0 PPP IP Add Route
17 0 1 0 0.00% 0.00% 0.00% 0 X.25 Encaps Manage
18 4506 1062 4242 0.00% 0.01% 0.00% 0 TCP Timer
19 793 104 7625 0.00% 0.00% 0.00% 0 TCP Protocols
20 0 1 0 0.00% 0.00% 0.00% 0 Probe Input
21 0 1 0 0.00% 0.00% 0.00% 0 RARP Input
PID Runtime(ms) Invoked uSecs 5Sec 1Min 5Min TTY Process
22 72 24 3000 0.00% 0.00% 0.00% 0 BOOTP Server
23 2984786 5042472 591 0.08% 0.04% 0.04% 0 IP Background
24 71790621 177958 403426 8.43% 1.04% 0.74% 0 IP Cache Ager
25 0 1 0 0.00% 0.00% 0.00% 0 PAD InCall
26 0 2 0 0.00% 0.00% 0.00% 0 X.25 Background
27 0 1 0 0.00% 0.00% 0.00% 0 ISDN Timer
28 0 1 0 0.00% 0.00% 0.00% 0 IP NAT Ager
29 0 1 0 0.00% 0.00% 0.00% 0 ISDNMIB Background
30 0 1 0 0.00% 0.00% 0.00% 0 CallMIB Background
31 0 1 0 0.00% 0.00% 0.00% 0 SNMP ConfCopyProc
32 0 1 0 0.00% 0.00% 0.00% 0 Syslog Traps
33 0 1 0 0.00% 0.00% 0.00% 0 Entity MIB API
34 1510 31 48709 0.00% 0.00% 0.00% 0 Critical Bkgnd
35 8345412 57894 144149 0.00% 0.00% 0.00% 0 Net Background
36 92 262 351 0.00% 0.00% 0.00% 0 Logger
37 11982458 4956296 2417 0.00% 0.07% 0.06% 0 TTY Background
38 2260808 4956300 456 0.00% 0.00% 0.00% 0 Per-Second Jobs
39 7682744 4956299 1550 0.00% 0.04% 0.04% 0 Net Periodic
40 402118 500006 804 0.00% 0.00% 0.00% 0 Net Input
41 1732242 1024323 1691 0.00% 0.00% 0.00% 0 Compute load avgs
42 16270898 86085 189011 0.00% 0.11% 0.08% 0 Per-minute Jobs
44 0 1 0 0.00% 0.00% 0.00% 0 SNMP Timers
PID Runtime(ms) Invoked uSecs 5Sec 1Min 5Min TTY Process
45 27837831 1595751 17445 0.00% 0.16% 0.47% 0 IP SNMP
46 0 21 0 0.00% 0.00% 0.00% 0 SNMP Traps
47 1046788 86341 12123 0.00% 0.00% 0.00% 0 IP-RT Background
48 5172805 379082 13645 0.00% 0.13% 0.11% 0 RIP Router
49 346932 185680 1868 0.00% 0.00% 0.00% 0 RIP Send

 

[LiNuXGuRL]

i am not sure if the high load is caused by your access lists. however, it looks like the router cannot handle all that traffic. check you interfaces for the load.
also try to disable process switching and enabling fast switching (ip route-cache) on the interface.

here is a cisco link regarding high cpu util.

http://www.cisco.com/warp/customer/63/highcpu.html#4

 

[LiNuXGuRL]

one more thought:

if you have ip route cash enabled, it will not change the fact that extented access lists will still be worked down in process switching. to find out if the access lists are your problem, go ahead and take them off to see if the cpu problem still exists.

 

[bshady]

First off, thak you very much for your assistance!

Second, removing the ACLs seem to decrease some of the load on the processors however, the bandwidth utilization goes "through the roof".

Is there anything I can do, short of buying a couple of "bigger, bettter, faster" routers?

Thanks again!

 

[LiNuXGuRL]

how about getting a firewall?
are the users on the site producing this traffic? or maybe some misconfig of the lan, in connection to default routes? you could also do an ip accounting (but not while your cpu load is this high) to see which hosts are the top utilizers..