Detect routers operating in process-switching mode
Sometimes the CPU utilization on a router would raise unexpectedly due to incoming packets being process switched. A very common scenario is a GRE tail-end router that has to reassemble IP fragments (usually generated due to incorrect MTU size on the GRE head-end or due to IPSec+GRE combination) or a router under Denial-of-Service attack. To detect these conditions, you can define Embedded Resource Manager (ERM) policy that raises an alert when the CPU utilization of the IP Input process exceeds predefined limits.
resource policyAnd here are some more ERM usage guidelines:
policy HighProcCPU type iosprocess
critical rising 40 falling 25
major rising 20 falling 10
user group IPInput type iosprocess
instance "IP Input"
- This time, we're monitoring a group of processes, so the policy definition is no longer global but has a type (iosprocess is the only type defined at the moment).
- As in the previous ERM example, we're monitoring CPU utilization of the main CPU (system), but this time we're interested in the process utilization.
- The policy is applied to a user group of resources of the type iosprocess (translated into English: a group of IOS processes).
- The only process in this group is the IP Input process (and the "magic keyword" is an instance of the group).
The quotes in the instance configuration command are required, as the command accepts only a single word as the process name.
Thanks for this
How do I trip this to test that it is actually working and being reported correctly?