Where Have You Been All My Life?

I just recently discovered that you can sort the output of “show processes” commands.  The fact that I just recently found out about the sort option means that it’s probably been there for years.

r1#sh proc cpu ?
  history  Show CPU history in graph format
  sorted   Show sorted output based on percentage of utilization
  |        Output modifiers
  <cr>

r1#sh proc cpu sorted ?
  1min  Sort based on 1 minute utilization
  5min  Sort based on 5 minutes utilization
  5sec  Sort based on 5 seconds utilization
  |     Output modifiers
  <cr>

r1#sh proc cpu sorted
CPU utilization for five seconds: 0%/0%; one minute: 0%; five minutes: 0%
 PID Runtime(ms)   Invoked      uSecs   5Sec   1Min   5Min TTY Process
  36      195092   5027891         38  0.07%  0.08%  0.07%   0 Per-Second Jobs
 149       16096  50258709          0  0.07%  0.02%  0.00%   0 CCPROXY_CT
   2         244   1005901          0  0.00%  0.00%  0.00%   0 Load Meter
   4           0         1          0  0.00%  0.00%  0.00%   0 EDDRI_MAIN
   3      109264   1968991         55  0.00%  0.00%  0.00%   0 OSPF Hello 100
   1           0         4          0  0.00%  0.00%  0.00%   0 Chunk Manager
…
 124          16        52        307  0.00%  0.02%  0.00%   2 Virtual Exec
…
 176     5404540    335473      16110  0.00%  0.06%  0.05%   0 BGP Scanner

Looks like the default is 5sec (otherwise we would not see entries further down the list for 1min and 5min).  I think that 5min is a better default.

r1#sh proc cpu sorted 5min
CPU utilization for five seconds: 1%/0%; one minute: 0%; five minutes: 0%
 PID Runtime(ms)   Invoked      uSecs   5Sec   1Min   5Min TTY Process
  36      195096   5028041         38  0.00%  0.07%  0.07%   0 Per-Second Jobs
 176     5404720    335483      16110  0.00%  0.10%  0.06%   0 BGP Scanner
   5     3289732    510713       6441  0.63%  0.09%  0.06%   0 Check heaps
  54      282196   2531018        111  0.07%  0.00%  0.00%   0 IP Input
  89        9648  50260186          0  0.07%  0.01%  0.00%   0 RBSCP Background

Because a process could hammer your cpu for 4minutes and 54 seconds and could be buried in the default sort (5sec), you may still want to use the unwieldy “sh proc cpu | e 0.00%  0.00%  0.00%” command as it will show processes that have used the cpu in any of the three time intervals:

r1#sh proc cpu | e 0.00%  0.00%  0.00%
CPU utilization for five seconds: 3%/1%; one minute: 1%; five minutes: 0%
 PID Runtime(ms)   Invoked      uSecs   5Sec   1Min   5Min TTY Process
   5     3289796    510727       6441  0.00%  0.04%  0.05%   0 Check heaps
  36      195104   5028200         38  0.07%  0.08%  0.07%   0 Per-Second Jobs
  54      282208   2531191        111  0.07%  0.01%  0.00%   0 IP Input
  89        9648  50261772          0  0.00%  0.01%  0.00%   0 RBSCP Background
 124          88      4060         21  0.15%  0.03%  0.00%   2 Virtual Exec
 145     1093612     85603      12775  0.23%  0.02%  0.00%   0 Per-minute Jobs
 149       16096  50261800          0  0.00%  0.02%  0.00%   0 CCPROXY_CT
 176     5404900    335494      16110  1.27%  0.15%  0.07%   0 BGP Scanner

Remember that you also have the “graphic” output of the “show processes cpu history”:

r1#show proc cpu hist

r1   01:44:11 PM Saturday Jun 30 2007 CDT

    11111                         11111               22222
100
 90
 80
 70
 60
 50
 40
 30
 20
 10
   0….5….1….1….2….2….3….3….4….4….5….5….
             0    5    0    5    0    5    0    5    0    5
               CPU% per second (last 60 seconds)
    2322222222222222222232232222222222222222232222232333222222
100
 90
 80
 70
 60
 50
 40
 30
 20
 10
   0….5….1….1….2….2….3….3….4….4….5….5….
             0    5    0    5    0    5    0    5    0    5
               CPU% per minute (last 60 minutes)
              * = maximum CPU%   # = average CPU%

                1     1122332332231            122222322221            122
    4846454332452553460424118209921765555565579423697077635535457533458356
100
 90
 80
 70
 60
 50
 40
 30                       ********                *******               ****
 20                     *########*              *########**             *###
 10  * * *     ****  **############************###########** * ***   **#####
   0….5….1….1….2….2….3….3….4….4….5….5….6….6….7.
             0    5    0    5    0    5    0    5    0    5    0    5    0
                   CPU% per hour (last 72 hours)
                  * = maximum CPU%   # = average CPU%

Wow!!! That’s purty. 

Cisco Documentation:

show processes cpu