An AR3260 router in an office in country N is impacted by SNMP packets, causing a high CPU usage on the main control plane

1

Root analysis: The SNMP process is overloaded.
Troubleshooting procedure:
1. The NMS fails to manage the AR, therefore corresponding link may not be reached. Perform a ping test, and find that the link is reachable.
2. Check the CPU usage of the AR router, and find that the SNMP process is overloaded (peak: 56.2%). Run the display snmp-agent statistics command, and find a great number of SNMP query packets (shown as below). The fault may be caused by the excessive SNMP query packets received from the intranet NMS. Measure traffic on the Ethernet aggregation link that connects to the intranet server, and find that a great number of SNMP packets are not received from the intranet.
3. Run the debug snmp-agent packet command and find that the packets are sent from a public network address (shown as below). Measure traffic on the WAN interface to confirm the finding. Apply a streaming policy to the WAN interface to filter the SNMP packets. The CPU usage on the main control plane drops back to normal.
For details, see the URL: CPU Usage of the Main Control Plane on the AR3260 Is High Because of Many SNMP Packets.

Other related questions:
CPU usage of the AR3260 is too high
The reason why the CPU usage of the AR3260 is high may be that the AR is attacked, which can be identified as follows: 1. Run the display snmp-agent statistics command to view SNMP statistics, and check whether the number of SNMP packets received on the AR exceeds the queue buffer and some packets cannot be processed. 2. Capture packets to check whether the AR is attacked. For details, see CPU Usage of an AR3260 Is Too High.

How to determine whether CPU usages of the system and processes are high for S series switches
For S series switches (except the S1700), the system CPU usage is within a normal range when the following conditions are met: - The CPU usage does not exceed 80% when the system runs for a long period. - The CPU usage does not exceed 95% in a short period and does not keep increasing. - No high CPU usage alarm is generated. In the following situations, the system may generate an alarm when CPU usage becomes high instantly and then clear this alarm rapidly: Cards just start. Information about all optical modules is queried at a time. Traffic volume increases instantly. This situation is a normal situation and does not affect the device operation. CPU usage of a CPU task process may become low or high, depending on the service volume and processing time. CPU usage is within a normal range as long as the system CPU usage does not exceed 80% and no high CPU usage alarm is generated. For possible causes and common troubleshooting procedures for high CPU usage, see the following: - For the S12700, see "High CPU Usage > Common Information" in S12700 Troubleshooting - Preliminary. - For the S7700 and S9700, see "High CPU Usage > Common Information" in S7700&S9700 Troubleshooting - Preliminary. - For the S1720, S2700, S3700, S5700, and S6700, see "High CPU Usage > Common Information" in S1720&S2700&S3700&S5700&S6700 Troubleshooting - Preliminary. - For the S9300, see "High CPU Usage > Common Information" in S9300 Troubleshooting - Preliminary. - For the S600-E, see "High CPU Usage > Common Information" in S600-E Troubleshooting - Preliminary.

CE series switches have high CPU usage, then how to quickly locate the cause and collect CPU information
If the CPU usage of the device is high, perform the following steps to locate and collect information, and then send the information to Huawei technical support personnel. 1. Run the display cpu command to view the services with the high CPU usage. display cpu CPU utilization statistics at 2016-02-02 02:07:22 366 ms System CPU Using Percentage : 6% CPU utilization for five seconds: 6%, one minute: 6%, five minutes: 6%. Max CPU Usage : 38% Max CPU Usage Stat. Time : 2016-02-01 12:29:26 821 ms State: Non-overload Overload threshold: 90%, Overload clear threshold: 75%, Duration: 480s --------------------------- ServiceName UseRate --------------------------- SYSTEM 6% AAA 0% ARP 0% CMF 0% ...... 2. Run the display system service service-name command repeatedly in the diagnostic view to check the service components with the high CPU usage. system-view [~HUAWEI] diagnose [~HUAWEI-diagnose] display system service SYSTEM Service : SYSTEM -------------------------------------------------------------------------------- Component CID CGID Process HaState CpuUsage MemUsage -------------------------------------------------------------------------------- DFS 0x81DE271D 0x1DE271B 10003 PRIMARY 0% 4006312 TELC 0x8091271F 0x91271D 10001 PRIMARY 0% 19000 SSHC 0x80922720 0x92271E 10001 PRIMARY 0% 41208 SSHS 0x80932723 0x932721 10001 PRIMARY 0% 48844 3. Run the display system thread process process-id command repeatedly in the diagnostic view to check the processes with the high CPU usage. system-view [~HUAWEI] diagnose [~HUAWEI-diagnose] display system thread process 10003 Info: This operation needs several seconds. Info: Operating, please wait for a moment......done. ------------------------------------------------------------------------------- Process ID Thread ID Thread Type BindComp BindCpu BindFlag Usage ------------------------------------------------------------------------------- 10003 1210525456 main thread Bind all Free 0% 10003 1227637888 DefSch0200 Free all Free 0% 10003 1227506816 IPC0000 Free all Free 0% 10003 1227768960 DefSch0300 Free all Free 0% 10003 1237476480 DefSch0100 Free all Free 0% 10003 1237607552 DefSch0101 Free all Free 0% 10003 1226847360 DMS_PIPE_RECV_TASK Free all Free 0% 10003 1218028672 TICK Free all Free 0% 10003 1226716288 DMS_TIPC_SEND Free all Free 0% 10003 1217766528 BOX_Out Free all Free 0% 10003 1217897600 VCLK Free 0 Free 0% 10003 1237738624 CliGetThreadCpu Free all Free 0% ------------------------------------------------------------------------------- Total = 12 4. Run the display system thread callstack process process-id thread-id command in the diagnostic view to check process call stack information. system-view [~HUAWEI] diagnose [~HUAWEI-diagnose] display system thread callstack process 10003 1210525456 Thread 1210525456 (Thread MainThread): #00 libc.so.6(epoll_wait) #01 location(Frame_FdMainThread) #02 location(Frame_Main) #03 location(main) #04 libc.so.6() #05 libc.so.6()

If you have more questions, you can seek help from following ways:
To iKnow To Live Chat
Scroll to top