SNMP ENGINE process has high CPU usage on a few 6500 chassis

Question

Four of our 6500 chassis have a constant high CPU usage from the SNMP ENGINE process. Three of the chassis run around 20-30% constantly and the fourth is running around 50% constantly. We have about thirty more 6500s that are showing no issues at all. To the best of my knowledge we are monitoring the same exact OIDs on all 6500 chassis. Is there a show command that will display what OID being polled is causing so much CPU to be used?

I implemented the "snmp-server view cutdown" from here and it dropped the CPU down a bit but really need to find a solution other than this.

Answer 1

I would take a look at this support document from Cisco.

In part it recommends to run the following command to see which OID's were recently polled:

show snmp stats oid

This gives a readout for which OID's you are polling. It will allow you to see, by judging the time stamps, which OID is taking a long time to poll. This is usually where your problem lies. See the below sample output:

asr1001-1#show snmp stats oid

time-stamp               #of times requested             OID
20:31:33 EDT May 25 2013         1142                    ifOutDiscards
20:31:33 EDT May 25 2013         1142                    ifOutErrors
20:31:33 EDT May 25 2013         1142                    ifInDiscards
20:31:33 EDT May 25 2013         1142                    ifInErrors
20:31:33 EDT May 25 2013         1142                    ifHCOutOctets
20:31:33 EDT May 25 2013         1902                    ifHCInOctets

However do note that it was only added in IOS release 12.4(20)T and 12.0(22)S, so may not be available to you.

---

In the linked document there are some other methods such as:

1. Sniffing the packets on the port to see what OID's are being polled heavily
2. Using debug snmp packets

They aren't as nice and neat as the show snmp stats oid but they can help you out if that command isn't available.