snmp { health-monitor { interval 30; rising-threshold 60; falling-threshold 50; } }

event-options { policy MONITOR-CPU { events snmpd_health_mon_thresh_cross; attributes-match { snmpd_health_mon_thresh_cross.event-name matches "Health Monitor.+CPU.+rising"; } then { execute-commands { commands { "show system processes extensive"; } output-filename cpu-processes; destination local-flash; output-format text; } }
} destinations { local-flash { archive-sites { /var/tmp; } } } }

DISPLAY SET OUTPUT> set snmp health-monitor interval 30 set snmp health-monitor rising-threshold 60 set snmp health-monitor falling-threshold 50 set event-options policy MONITOR-CPU events snmpd_health_mon_thresh_cross set event-options policy MONITOR-CPU attributes-match snmpd_health_mon_thresh_cross.event-name matches "Health Monitor.+CPU.+rising" set event-options policy MONITOR-CPU then execute-commands commands "show system processes extensive" set event-options policy MONITOR-CPU then execute-commands output-filename cpu-processes set event-options policy MONITOR-CPU then execute-commands destination local-flash set event-options policy MONITOR-CPU then execute-commands output-format text set event-options destinations local-flash archive-sites /var/tmp

show ddos-protection protocols statistics brief show ddos-protection statistics show ddos-protection version

Then depending what you see it can be narrowed down for example: show ddos-protection protocols ttl statistics show ddos-protection protocols ttl violations show ddos-protection protocols ttl flow-detection detail /this cm needs prior config/

set cli timestamp show chassis routing-engine (multiple snapshots, atleast 5) show system processes extensive (multiple snapshots atleast 5) show system users show system connections show system statistics

Turn on task accounting and collect the task accounting detail output (three times with a gap of 30 seconds). Don't forget to turn it off after finished.

set task accounting on show task accounting detail set task accounting off

show task memory detail show task memeory summary show task io show task history show task statistics show task job show task jobs show krt queue show krt state

user@router# show routing-options traceoptions { file routing-trace size 10m files 20 world-readable; flag task; flag state; flag timer; }

snmp {
    health-monitor {
        interval 30;
        rising-threshold 60;
        falling-threshold 50;
    }
}
 
event-options {
    policy MONITOR-CPU {
        events snmpd_health_mon_thresh_cross;
        attributes-match {
            snmpd_health_mon_thresh_cross.event-name matches "Health Monitor.+CPU.+rising";
        }
        then {
            execute-commands {
                commands {
                    "show system processes extensive";
                }
                output-filename cpu-processes;
                destination local-flash;
                output-format text;
            }
        }                               
    }
    destinations {
        local-flash {
            archive-sites {
                /var/tmp;
            }
        }
    }
}
 

DISPLAY SET OUTPUT>

set snmp health-monitor interval 30
set snmp health-monitor rising-threshold 60
set snmp health-monitor falling-threshold 50
set event-options policy MONITOR-CPU events snmpd_health_mon_thresh_cross
set event-options policy MONITOR-CPU attributes-match snmpd_health_mon_thresh_cross.event-name matches "Health Monitor.+CPU.+rising"
set event-options policy MONITOR-CPU then execute-commands commands "show system processes extensive"
set event-options policy MONITOR-CPU then execute-commands output-filename cpu-processes
set event-options policy MONITOR-CPU then execute-commands destination local-flash
set event-options policy MONITOR-CPU then execute-commands output-format text
set event-options destinations local-flash archive-sites /var/tmp

show ddos-protection protocols statistics brief
show ddos-protection statistics
show ddos-protection version
 

Then depending what you see it can be narrowed down for example:

show ddos-protection protocols ttl statistics
show ddos-protection protocols ttl violations
show ddos-protection protocols ttl flow-detection detail  */*this cm needs prior config*/*

set cli timestamp
show chassis routing-engine (multiple snapshots, atleast 5)
show system processes extensive (multiple snapshots atleast 5)
show system users
show system connections
show system statistics

Turn on task accounting and collect the task accounting detail output (three times with a gap of 30 seconds). Don't forget to turn it off after finished.

set task accounting on 
show task accounting detail
set task accounting off

show task memory detail
show task memeory summary
show task io
show task history
show task statistics
show task job
show task jobs
show krt queue
show krt state

user@router# show routing-options 
traceoptions { 
file routing-trace size 10m files 20 world-readable; 
flag task; 
flag state; 
flag timer; 
}