1.Run the auto-defend enable command to configure attack source tracing. If a possible attack source is detected, check on the network to determine whether it is a real attack source.
2.If a real attack source exists, run the blacklist command to add the attack source to the blacklist or run the auto-defend action command to configure a punish action for the attack source. If no attack source exists, run the car command to increase the CPCAR value properly.
NOTE:Improper CPCAR settings will affect services on your network. If you need to adjust CPCAR settings, you are advised to contact technical support personnel for help.

@welisson_br hello,
from your description, it seems the massive IGMP join/leave messages coursed the high CPU usage.
you are kindly advised to check if there is any network loops in the network.

@welisson_br well, if you confirm that the high cpu usage is caused by the massive igmp join/leave packets, this is a normal scene, you are kindly advised to check if there are too many multicast users connected to the switch? Also, you can optimize the network.

 DEFD/4/CPCAR_DROP_LPU

Message

DEFD/4/CPCAR_DROP_LPU:Rate of packets to cpu exceeded the CPCAR limit on the LPU in slot [STRING]. (Protocol=[STRING], CIR/CBS=[ULONG]/[ULONG], ExceededPacketCount=[STRING])

Description

The rate of packets delivered to the CPU exceeds the CPCAR limit on the specified device.

Parameters

Parameter Name	Parameter Meaning
slot	Specifies the slot ID if stacking is not configured. Specifies the stack ID if stacking is configured.
Protocol	Indicates the protocol type.
CIR/CBS	Indicates the committed information rate and committed burst size.
ExceededPacketCount	Specifies the number of packets whose rate exceeds the CPCAR.

Possible Causes

The rate of packets sent to the CPU of the specified device exceeds the CPCAR.

Procedure

1. Run the auto-defend enable command to configure attack source tracing. If a possible attack source is detected, check on the network to determine whether it is a real attack source.

2. If a real attack source exists, run the blacklist command to add the attack source to the blacklist or run the auto-defend action command to configure a punish action for the attack source. If no attack source exists, run the car (attack defense policy view) command to increase the CPCAR value properly.

    

   

   Improper CPCAR settings will affect services on your network. If you need to adjust CPCAR settings, you are advised to contact technical support personnel for help.

____________________________________________________________________________________________________________________________________

DEFD/4/CPCAR_DROP_MPU

Message

DEFD/4/CPCAR_DROP_MPU:Rate of packets to cpu exceeded the CPCAR limit on the MPU. (Protocol=[STRING], CIR/CBS=[ULONG]/[ULONG], ExceededPacketCount=[STRING])

Description

The rate of packets delivered to the CPU exceeds the CPCAR limit.

Parameters

Parameter Name	Parameter Meaning
Protocol	Indicates the protocol type.
CIR/CBS	Indicates the committed information rate and committed burst size.
ExceededPacketCount	Indicates the number of packets whose rate exceeds the CPCAR.

Possible Causes

The rate of packets delivered to the CPU exceeded the CPCAR limit. As a result, some packets are discarded.

Procedure

1. Control the rate of packets delivered to the CPU within the CPCAR limit, or run the car packet-type packet-type cir cir-value [ cbs cbs-value ] command to configure a proper CPCAR limit.

    

   

   Improper CPCAR settings will affect services on your network. If you need to adjust CPCAR settings, you are advised to contact technical support personnel for help.

____________________________________________________________________________________________________________________________________

SECE/3/QUEUE_DROP

Message

SECE/3/QUEUE_DROP: Rate of packets to cpu exceeded the QUEUE limit. (SlotId=[STRING], Queue0DropNumber=[STRING], Queue1DropNumber=[STRING], Queue2DropNumber=[STRING], Queue3DropNumber=[STRING], Queue4DropNumber=[STRING], Queue5DropNumber=[STRING], Queue6DropNumber=[STRING], Queue7DropNumber=[STRING])

Description

Some packets in queues sent to the CPU were dropped.

Parameters

Parameter Name	Parameter Meaning
SlotId	On a standalone switch, it specifies a slot ID. On a stacked switch, it specifies a stack ID.
Queue0DropNumber/Queue1DropNumber/Queue2DropNumber/Queue3DropNumber/Queue4DropNumber/Queue5DropNumber/Queue6DropNumber/Queue7DropNumber	Indicates the number of packets dropped in every 10 minutes in queues 0 to 7.

Possible Causes

A large CPCAR value was set for packets to be sent to the CPU. As a result, a large number of packets were sent to the CPU.

Procedure

1. Run the display cpu-defend configuration slot slot-id command to check whether the CPCAR value configured for each type of protocol packets is correct. The default CPCAR value is recommended.

2. Collect log information and configuration information, and then contact technical support personnel.You can collect diagnostic information using the display diagnostic-information command.

One question I've been wondering about that situation, Is there some limitation on that switch model when we talk about traffic igmp/multicast (heavy traffic)?
Does anyone from Huawei who can answer me, pls?

Yes, igmp limit function could restrict the number of multicast groups allowed in the system and on an interface.
please refer this https://support.huawei.com/hedex/hdx.do?docid=EDOC1100037168&id=dc_cfg_igmp_1019&lang=en

BTW, this is a temporary solution, I think, it's better to split part of the users to other devices.