You can use the show process cpu sorted command in combination with an output filter to display only those IOS processes that consumed noticeable amount of CPU time in the last five minutes, last minute or last five seconds. Use the following patterns to construct your regular expression:

• The [0-9.]+% pattern will match any non-zero percentage;
• The 0.00% pattern will obviously match the zero-percentage display;
• As the percentage figures are separated by various amounts of whitespace characters, we have to use the ' +' pattern to match those;

The show filter should exclude the processes that have the zero percentage in the desired column and any percentage in the other two columns (any other filter would show too many or too few processes). To display processes active in the last minute, use the show process cpu sorted 1min | exclude [0-9.]+% +0.00% +[0-9.]+% command (and define an alias to make it easier to use). You could use these configuration commands to define the aliases:

alias exec cpu1min show process cpu sorted 1min | exclude [0-9.]+% +0.00%
+[0-9.]+%
alias exec cpu5sec show process cpu sorted 5sec | exclude 0.00% +[0-9.]+% +[0-9.]+%
alias exec cpu5min show process cpu sorted 5min | exclude [0-9.]+% +[0-9.]+% +0.00%

A sample printout from one of my routers is included:

rtr#cpu1min
CPU utilization for five seconds: 4%/0%; one minute: 2%; five minutes: 2%
 PID Runtime(ms)   Invoked      uSecs   5Sec   1Min   5Min TTY Process
   5    27260472   1470452      18538  0.00%  1.74%  1.78%   0 Check heaps
  62         536       226       2371  3.27%  0.52%  0.15%   2 Virtual Exec
  30      248000    230369       1076  0.16%  0.07%  0.02%   0 IP Input
  25      617780     25736      24004  0.00%  0.03%  0.00%   0 Per-minute
  43          32       485         65  0.00%  0.01%  0.00%   0 TCP Timer