CPU usage of the AR3260 is too high

43

The reason why the CPU usage of the AR3260 is high may be that the AR is attacked, which can be identified as follows:
1. Run the display snmp-agent statistics command to view SNMP statistics, and check whether the number of SNMP packets received on the AR exceeds the queue buffer and some packets cannot be processed.
2. Capture packets to check whether the AR is attacked.
For details, see CPU Usage of an AR3260 Is Too High.

Other related questions:
How to determine whether CPU usages of the system and processes are high for S series switches
For S series switches (except the S1700), the system CPU usage is within a normal range when the following conditions are met: - The CPU usage does not exceed 80% when the system runs for a long period. - The CPU usage does not exceed 95% in a short period and does not keep increasing. - No high CPU usage alarm is generated. In the following situations, the system may generate an alarm when CPU usage becomes high instantly and then clear this alarm rapidly: Cards just start. Information about all optical modules is queried at a time. Traffic volume increases instantly. This situation is a normal situation and does not affect the device operation. CPU usage of a CPU task process may become low or high, depending on the service volume and processing time. CPU usage is within a normal range as long as the system CPU usage does not exceed 80% and no high CPU usage alarm is generated. For possible causes and common troubleshooting procedures for high CPU usage, see the following: - For the S12700, see "High CPU Usage > Common Information" in S12700 Troubleshooting - Preliminary. - For the S7700 and S9700, see "High CPU Usage > Common Information" in S7700&S9700 Troubleshooting - Preliminary. - For the S1720, S2700, S3700, S5700, and S6700, see "High CPU Usage > Common Information" in S1720&S2700&S3700&S5700&S6700 Troubleshooting - Preliminary. - For the S9300, see "High CPU Usage > Common Information" in S9300 Troubleshooting - Preliminary. - For the S600-E, see "High CPU Usage > Common Information" in S600-E Troubleshooting - Preliminary.

An AR3260 router in an office in country N is impacted by SNMP packets, causing a high CPU usage on the main control plane
Root analysis: The SNMP process is overloaded. Troubleshooting procedure: 1. The NMS fails to manage the AR, therefore corresponding link may not be reached. Perform a ping test, and find that the link is reachable. 2. Check the CPU usage of the AR router, and find that the SNMP process is overloaded (peak: 56.2%). Run the display snmp-agent statistics command, and find a great number of SNMP query packets (shown as below). The fault may be caused by the excessive SNMP query packets received from the intranet NMS. Measure traffic on the Ethernet aggregation link that connects to the intranet server, and find that a great number of SNMP packets are not received from the intranet. 3. Run the debug snmp-agent packet command and find that the packets are sent from a public network address (shown as below). Measure traffic on the WAN interface to confirm the finding. Apply a streaming policy to the WAN interface to filter the SNMP packets. The CPU usage on the main control plane drops back to normal. For details, see the URL: CPU Usage of the Main Control Plane on the AR3260 Is High Because of Many SNMP Packets.

If you have more questions, you can seek help from following ways:
To iKnow To Live Chat
Scroll to top