Daren Matthews

This EEM applet reads the Cisco “cpmCPUTotal5sec” object variable in the CISCO-PROCESS-MIB and triggers when the threshold exceeds 60 %.  Three files are stored on the flash, containing the output of the CLI command “show process cpu | sorted” and “show ip traffic” as well as the current syslog.

event manager applet CPU-HIGH
event snmp oid 1.3.6.1.4.1.9.9.109.1.1.1.1.3 get-type next entry-op gt entry-val 60 poll-interval 5
action 0.1 cli command “enable”
action 0.2 syslog msg “Capturing high cpu information to flash:”
action 0.3 cli command “term length 0”
action 1.1 cli command “show process cpu sorted | append flash:EEM_CPU_HIGH”
action 1.4 cli command “show ip traffic | append flash:EEM_CURR_TRAFFIC”
action 1.4 cli command “show logging | append flash:EEM_SYSLOG”
action 4.2 syslog msg “Removing EEM APPLET from running_config”
action 9.2 cli command “configure terminal”
action 9.3 cli command “no event manager applet CPU-HIGH”
action 9.4 cli command “end”
action 9.5 cli command “term default length”

Output from the show processes CPU command on Cisco IOS Software Release 12.0(9):

Router# show processes CPU

CPU Utilisation for five seconds: 2%A/1%B; one minute: 1%C; five minutes: 1%D
PID  Runtime(ms)  Invoked  uSecs    5Sec   1Min   5Min TTY Process
1         164    137902      1   0.00%  0.00%  0.00%   0 Load Meter
2         100       119    840   0.57%  0.11%  0.02%   2 Virtual Exec
3      468644     81652   5739   0.00%  0.04%  0.05%   0 Check heaps
4           0         1      0   0.00%  0.00%  0.00%   0 Pool Manager
5           0         2      0   0.00%  0.00%  0.00%   0 Timers
6           0         2      0   0.00%  0.00%  0.00%   0 Serial Background
7           0         1      0   0.00%  0.00%  0.00%   0 OIR Handler
8           0         1      0   0.00%  0.00%  0.00%   0 IPC Zone Manager
9         348    689225      0   0.00%  0.00%  0.00%   0 IPC Periodic Tim
10           0         1      0   0.00%  0.00%  0.00%   0 IPC Seat Manager
11      175300    332916    526   0.00%  0.02%  0.00%   0 ARP Input
12        3824    138903     27   0.00%  0.00%  0.00%   0 HC Counter Timer
13           0         2      0   0.00%  0.00%  0.00%   0 DDR Timers
14           0         1      0   0.00%  0.00%  0.00%   0 Entity MIB API
15           0         1      0   0.00%  0.00%  0.00%   0 SERIAL A’detect
16           0         1      0   0.00%  0.00%  0.00%   0 Microcode Loader
17           0         1      0   0.00%  0.00%  0.00%   0 IP Crashinfo Inp
–<snip>–

Caution: When you poll SNMP variables, the CPU utilisation is affected. Continually polling at 1-second intervals can peg the CPU at 99 percent.

High CPU detection using CLI:
Router#sh processes cpu sorted ?

1min  Sort based on 1 minute Utilisation
5min  Sort based on 5 minutes Utilisation
5sec  Sort based on 5 seconds Utilisation
|     Output modifiers
<cr>

Router#sh processes cpu sorted 5min
CPU Utilisation for five seconds: 2%/0%; one minute: 2%; five minutes: 1%
PID Runtime(ms)     Invoked      uSecs   5Sec   1Min   5Min TTY Process
179         168    28275159          0  0.79%  0.76%  0.77%   0 HQF Shaper Backg
307         160     3529216          0  0.23%  0.18%  0.16%   0 PPP manager
5      141912       13430      10566  0.00%  0.10%  0.11%   0 Check heaps
308         248     3529216          0  0.15%  0.09%  0.08%   0 PPP Events
122       26424        5141       5139  0.39%  0.24%  0.06%   0 Exec
2          36       22595          1  0.07%  0.04%  0.05%   0 Load Meter
180          44     1129318          0  0.00%  0.03%  0.02%   0 RBSCP Background
312          16     1132266          0  0.00%  0.03%  0.02%   0 FR Broadcast Out
42          64      113310          0  0.07%  0.02%  0.00%   0 Per-Second Jobs
65          28      451871          0  0.00%  0.01%  0.00%   0 Netclock Backgro
273        1508       37676         40  0.00%  0.01%  0.00%   0 OSPF-1 Hello

Total CPU util. comprises process and interrupt percentages. These values are found on the first line of the output:
CPU Utilisation for five seconds: x%/y%; one minute: a%; five minutes: b%
Total CPU Utilisation: x%
Process Utilisation: (x – y)%
Interrupt Utilisation: y%
Process Utilisation is the difference between the Total and Interrupt (x and y). The one and five minute Utilisations are exponentially decayed averages (rather than an arithmetic average) therefore recent values have more influence on the calculated average.

References:
“How to Collect CPU Utilisation on Cisco IOS Devices Using SNMP”
http://www.cisco.com/en/US/tech/tk648/tk362/technologies_tech_note09186a0080094a94.shtml
Cisco SNMP Object Navigator for OID cpmCPUTotal5sec: http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?local=en&translate=Translate&objectInput=cpmCPUTotal5sec