On 01/10/10 16:24, Rin wrote:
Hi Phil,
Thanks for your email. Below is my answer:
Do you have any CoPP or MLS limiters enabled? I am thinking particularly
the TTL and MTU ones.
The CPU only spikes in less than a minute show I cannot catch it when it
high. I had CoPP applied as below
Since the system logs, you could use an EEM applet to trigger a "sh proc
cpu" and direct output to a file?
The output shows more than 12Mbps of traffic (matched by class-default) is
sending to CPU. I believe this is value is high but I could not determine
what type of traffic is sending to CPU
In which case I would SPAN the CPU.
You could ERSPAN the RP/SP CPU to a remote machine, then correlate CPU
spikes with the captured traffic.
How can I do this? Do you have any guideline?
conf t
mon sess 1 type erspan-source
source cpu rp
source cpu sp
destination
ip address <your monitoring box>
# various other options
exit
no shut
...then on your monitoring box, run "gulp | tcpdump" or "wireshark"
_______________________________________________
cisco-nsp mailing list cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
