What is this Cisco process?

Mailman List Mirror (Read Only)
1

Hello,

Have a Cisco 3560 running "flash:/c3560-ipbasek9-mz.122-55.SE1.bin". Been
running at 20% CPU since we started it:

[image: plf-access - CPU Usage]

The switch is completely layer-2... basic configuration. CPU utilization is
soley based on a single process:

plf-access#sh proc cpu sorted
CPU utilization for five seconds: 27%/0%; one minute: 25%; five minutes: 24%
PID Runtime(ms) Invoked uSecs 5Sec 1Min 5Min TTY Process
  41 232891470 1072247 217210 20.12% 18.99% 18.01% 0 SFF8472

  78 2376721 123621 19225 0.95% 0.22% 0.17% 0 HULC Tcam
Memory
303 299 163 1834 0.47% 0.23% 0.07% 2 SSH Process

  55 106535 11303527 9 0.15% 0.02% 0.00% 0 RedEarth Tx
Mana

Anybody have a clue what this process is?

Thanks for the time.

Cheers,

2

You mean the RedEarth process?

RedEarth Tx Mana: Microprocessor communication process

From:

http://www.cisco.com/en/US/docs/switches/lan/catalyst3750/software/troub
leshooting/cpu_util.html

3

You mean the RedEarth process?

I suspect he meant the SFF8472 process, using 20% of CPU...

plf-access#sh proc cpu sorted
CPU utilization for five seconds: 27%/0%; one minute: 25%; five minutes:
24%
PID Runtime(ms) Invoked uSecs 5Sec 1Min 5Min TTY Process
  41 232891470 1072247 217210 20.12% 18.99% 18.01% 0 SFF8472

SFF-8472 is the standard for monitoring mini-GBIC/SFP modules - perhaps he
has a 'bad' module in this router that's going haywire?

4

Hi Joe,

plf-access#sh proc cpu sorted
CPU utilization for five seconds: 27%/0%; one minute: 25%; five minutes: 24%
PID Runtime(ms) Invoked uSecs 5Sec 1Min 5Min TTY Process
  41 232891470 1072247 217210 20.12% 18.99% 18.01% 0 SFF8472

SFF8472 is very familiar:

I believe that might help explain a little.

I also found reference to it buried in a PDF: http://bit.ly/fZZcVp

So you may have some incompatible SFP there.

HTH

Tom

5

So thanks to all for the help. It was an SFP. Here is CPU with bad SFP:

   plf-access#

plf-access#sh proc cpu sorted

CPU utilization for five seconds: 11%/0%; one minute: 18%; five minutes: 21%

PID Runtime(ms) Invoked uSecs 5Sec 1Min 5Min TTY Process

  41 237737055 1095169 217078 5.11% 11.74% 14.87% 0 SFF8472

Here is CPU with SFP taken out:

   plf-access#sh proc cpu sorted

CPU utilization for five seconds: 5%/0%; one minute: 17%; five minutes: 21%

PID Runtime(ms) Invoked uSecs 5Sec 1Min 5Min TTY Process

106 322 437 736 0.79% 0.07% 0.03% 0 Exec

Confirmed it was the SFP by pulling it in and out a couple times. Processor
flapped right along.

Thanks again to all,

Joe

"Well, I have no direct experience with the 3560, but SFF-8472 is a spec
that includes diagnosting monitoring of SFPs..."

6

Ingen,

How did you know this? And I quote "Well, I have no direct experience with
the 3560, but SFF-8472 is a spec that includes diagnosting monitoring of
SFPs...". Really am I missing some secret search engine? Is google not the
answer? Please do let me know because if it was from an online resource I
want to know what it is.

Thanks again for the response... you solved my problem.

Cheers,

Joe

7

I wonder if you were seeing 14% CPU over 5min avg BECAUSE the SFP supported
DOM or was it a bug due to DOM. In other words, maybe the fact that the SFP
supported DOM just took up a bit more CPU due to the diagnostic function. Is
it normal I guess is what I'm wondering...

-J

8

Hi Joe,

How did you know this? And I quote "Well, I have no direct experience
with the 3560, but SFF-8472 is a spec that includes diagnosting
monitoring of SFPs...". Really am I missing some secret search
engine? Is google not the answer? Please do let me know because if
it was from an online resource I want to know what it is.

Well, I was triggered by the SFF designation because I've been hacking
SFP transceivers in my spare time... with the huge price markups on
transceivers by the big vendors, it's getting more interesting to buy
quality SFPs and alter the ID strings in a way that they are recognized
as "genuine Cisco" of "genuine HP".

Googling for SFF8472 will also get you hits (eg a great PDF at
ftp.seagate.com), but they might not seem relevant at first glance :slight_smile:

Thanks again for the response... you solved my problem.

Good to hear and you're welcome :slight_smile:

Regards,

Jeroen van Ingen
ICT Service Centre
University of Twente, P.O.Box 217, 7500 AE Enschede, The Netherlands