show processes cpu
Displays CPU utilization statistics for processes running on the Cisco Nexus switch.
Overview
The 'show processes cpu' command is a fundamental diagnostic tool on Cisco Nexus switches running NX-OS. It provides real-time and historical CPU utilization data for all processes running on the switch's control plane. Unlike IOS, where the command shows per-process CPU as a percentage of the total CPU, NX-OS displays utilization over three rolling time windows: 5 seconds, 1 minute, and 5 minutes. This multi-window approach helps distinguish between transient spikes and sustained high CPU. The command is essential for troubleshooting performance issues, such as slow management access, routing protocol instability, or high latency. In Nexus switches, the control plane CPU handles routing protocols, management functions, and exception packets; the data plane is typically hardware-switched. Therefore, high CPU often indicates control plane issues like excessive routing updates, spanning-tree topology changes, or denial-of-service attacks. The command can be used with the 'sort' parameter to order processes by CPU usage in a specific interval, making it easy to identify the top consumers. The 'detail' option provides additional information for a specific process, including memory usage, stack size, priority, and context switches. This command is part of the standard troubleshooting workflow: start with 'show processes cpu' to get an overview, then drill down into specific processes with 'detail', and correlate with other commands like 'show processes memory' or 'show system resources'. On Nexus, the command also includes a 'sort' option not available in IOS, which enhances its utility. Understanding how to interpret the output is critical for network engineers, especially when dealing with performance degradation or during certification exams like CCNP Data Center.
show processes cpu [sort {5sec | 1min | 5min}] [detail] [process <process-id>]When to Use This Command
- Identify processes consuming high CPU during network congestion or attacks.
- Troubleshoot slow performance or high latency by checking CPU load.
- Monitor control plane processes like OSPF, BGP, or STP for abnormal CPU usage.
- Verify CPU usage after configuration changes or software upgrades.
Parameters
| Parameter | Syntax | Description |
|---|---|---|
| sort | sort {5sec | 1min | 5min} | Sorts the process list by CPU usage in the specified time interval. Default is unsorted (by PID). Use '5sec' for immediate spikes, '1min' for short-term trends, '5min' for baseline load. |
| detail | detail | Displays detailed information for a specific process, including memory usage, stack size, priority, context switches, and interrupts. Must be used with 'process <process-id>'. |
| process | process <process-id> | Specifies the process ID to display detailed information for. Used with 'detail' to get in-depth data about a single process. |
Command Examples
Basic CPU utilization overview
show processes cpuCPU utilization for 5 seconds: 12%; 1 minute: 10%; 5 minutes: 9% PID Process 5Sec 1Min 5Min Status 1 init 0.0% 0.0% 0.0% Sleeping 2 kthreadd 0.0% 0.0% 0.0% Sleeping 3 migration/0 0.0% 0.0% 0.0% Running ... 1234 bgp-65000 2.5% 2.0% 1.8% Running 5678 ospf-1 1.2% 1.1% 1.0% Sleeping 9012 kernel-task 8.0% 7.5% 7.0% Running
The first line shows overall CPU utilization over three time intervals. The table lists each process with its PID, name, CPU usage over 5 seconds, 1 minute, and 5 minutes, and status. High values in 5Sec may indicate transient spikes; sustained high values in 1Min or 5Min suggest a persistent issue.
Sort by 1-minute CPU usage
show processes cpu sort 1minCPU utilization for 5 seconds: 15%; 1 minute: 14%; 5 minutes: 12% PID Process 5Sec 1Min 5Min Status 9012 kernel-task 9.0% 8.5% 8.0% Running 1234 bgp-65000 3.0% 2.5% 2.2% Running 5678 ospf-1 1.5% 1.3% 1.2% Sleeping ...
The output is sorted by the 1-minute average CPU usage in descending order, making it easier to identify the most CPU-intensive processes over a medium time frame.
Detailed CPU info for a specific process
show processes cpu process 1234 detailProcess ID: 1234 Process Name: bgp-65000 CPU Usage: 5Sec=2.5%, 1Min=2.0%, 5Min=1.8% Memory Usage: 45 MB Stack Size: 8192 bytes Priority: 10 Status: Running Context Switches: 12345 Interrupts: 678 ...
Provides detailed information about a specific process, including memory usage, stack size, priority, context switches, and interrupts. This helps in deep-dive troubleshooting of a particular process.
Understanding the Output
The first line of output shows the overall CPU utilization of the switch over three time windows: the last 5 seconds, 1 minute, and 5 minutes. These values represent the percentage of CPU capacity used by all processes combined. Healthy values are typically below 50% for the 5-minute average; sustained values above 70% may indicate a problem. The table lists each process with its PID, name, and CPU usage for the same three intervals. The 'Status' column indicates whether the process is running, sleeping, or stopped. Processes with high 5-second usage but low 1-minute and 5-minute usage may be handling transient bursts; consistently high values across all intervals suggest a process that is consuming excessive CPU. Key fields to watch: '5Sec' for immediate spikes, '1Min' for short-term trends, and '5Min' for baseline load. In NX-OS, the 'kernel-task' process often handles interrupt and scheduling overhead; high values here may indicate hardware or driver issues. The 'sort' parameter reorders the table by the specified interval, helping to quickly identify top consumers. The 'detail' option provides additional metrics like memory, stack, priority, and context switches, useful for in-depth analysis.
Configuration Scenarios
Identifying a CPU-hungry routing protocol
A Nexus 9000 switch is experiencing high CPU and slow OSPF convergence.
Topology
N9K-1 --- N9K-2 --- N9K-3
(OSPF area 0)Steps
- 1.SSH to the switch and enter EXEC mode.
- 2.Run 'show processes cpu sort 1min' to see top CPU consumers.
- 3.If OSPF process shows high CPU, run 'show processes cpu process <PID> detail' for more info.
- 4.Check OSPF logs with 'show ip ospf events' to identify flapping neighbors.
! No configuration change needed for monitoring; troubleshooting only.
Verify: After fixing OSPF issues, re-run 'show processes cpu sort 1min' to confirm CPU usage drops.
Watch out: High CPU on OSPF may be due to many LSA updates; ensure network is stable and timers are tuned.
Monitoring CPU during a DDoS attack
A Nexus 7000 switch is under a SYN flood attack, causing high CPU.
Topology
Internet --- N7K-1 --- CoreSteps
- 1.Run 'show processes cpu sort 5sec' to see immediate impact.
- 2.Look for 'kernel-task' or 'netstack' processes with high CPU.
- 3.Use 'show ip traffic' to see packet statistics.
- 4.Apply CoPP (Control Plane Policing) to rate-limit attack traffic.
! Example CoPP policy
class-map type control-plane match-all ATTACK
match access-group name BLOCK
policy-map type control-plane COPP
class ATTACK
police cir 1000 bc 1500
drop
control-plane
service-policy input COPPVerify: After applying CoPP, re-run 'show processes cpu sort 5sec' to verify CPU drops.
Watch out: CoPP can drop legitimate traffic if not tuned; use with caution and monitor.
Troubleshooting with This Command
When troubleshooting high CPU on a Nexus switch, start with 'show processes cpu' to get an overall picture. Look for processes with consistently high usage across all three time intervals. Common culprits include routing protocols (BGP, OSPF, EIGRP), spanning-tree, and kernel tasks. If a routing protocol shows high CPU, check for flapping neighbors, excessive route updates, or misconfigured timers. Use 'show ip ospf neighbor' or 'show bgp summary' to verify adjacency stability. For kernel-task high CPU, it often indicates interrupt handling from high packet rates; check 'show interface' for errors or 'show hardware capacity' for hardware forwarding issues. Use 'show processes cpu process <PID> detail' to get memory and context switch data; high context switches may indicate a process that is thrashing. Correlate with 'show processes memory' to see if memory pressure is causing swapping. In NX-OS, the 'system health' commands can also provide CPU history. For persistent high CPU, consider implementing CoPP to protect the control plane, or upgrade software if a known bug exists. Always check the release notes for CPU-related caveats. Remember that on Nexus switches, the CPU is only for control plane; data plane forwarding is done in hardware, so high CPU does not directly affect forwarding performance but can impact routing convergence and management access.
CCNA Exam Tips
Remember that 'show processes cpu' is used for control plane CPU; data plane forwarding is handled in hardware on Nexus switches.
In CCNP exams, know that high CPU can be caused by routing protocol flaps, spanning-tree TCNs, or ACL logging.
Use 'sort 5min' to identify persistent CPU hogs; use 'detail' to check process memory and priority.
Common Mistakes
Mistaking high 5-second CPU as a problem without checking longer averages; transient spikes are normal.
Ignoring the 'kernel-task' process; high kernel CPU may indicate a hardware issue or driver bug.
Assuming CPU usage is the only cause of performance issues; also check memory, buffers, and interface errors.
Platform Notes
On Cisco NX-OS, the 'show processes cpu' command differs from IOS in several ways. NX-OS provides three time windows (5sec, 1min, 5min) while IOS typically shows 5sec, 1min, and 5min as well, but the output format is different. NX-OS includes a 'sort' parameter that IOS lacks, making it easier to identify top consumers. The 'detail' option in NX-OS provides more granular data like memory and stack size. On Nexus, the process list includes kernel tasks and platform-specific processes. Equivalent commands on other platforms: on Juniper JunOS, 'show system processes extensive' or 'show chassis routing-engine'; on Arista EOS, 'show processes top' or 'show cpu utilization'. In NX-OS versions prior to 7.x, the command may have slightly different output; always check the documentation for your specific version. The command is available in all NX-OS modes (EXEC, config) but typically used in EXEC. For real-time monitoring, use 'watch' or 'monitor' commands. Note that on Nexus 9000 series, CPU utilization can also be viewed via 'show system resources'.
Practice for the CCNA 200-301
Test your knowledge with hundreds of CCNA practice questions covering all exam domains.
Practice CCNA Questions