In which configuration mode is show processes cpu used?

The show processes cpu command is entered in Privileged EXEC mode on Cisco IOS devices.

SystemPrivileged EXEC

show processes cpu

Displays CPU utilization statistics for all processes running on the Cisco IOS device, used to identify processes consuming excessive CPU and diagnose performance issues.

Definition: show processes cpu is a Cisco IOS privileged exec command. Displays CPU utilization statistics for all processes running on the Cisco IOS device, used to identify processes consuming excessive CPU and diagnose performance issues.

Overview

The `show processes cpu` command is a fundamental diagnostic tool in Cisco IOS that displays real-time CPU utilization statistics for all running processes. It is essential for network engineers to identify processes consuming excessive CPU cycles, which can lead to performance degradation, packet loss, or device instability. The command provides a breakdown of CPU usage by process, including five-second, one-minute, and five-minute averages, as well as the runtime in milliseconds and the number of times the process has been invoked.

Understanding CPU utilization is critical because the CPU handles control plane functions such as routing protocol updates, management traffic (SSH, SNMP), and packet forwarding decisions when fast switching or CEF is not used. High CPU utilization can be caused by various factors: routing protocol flapping, excessive broadcast traffic, malicious attacks (e.g., DoS), or inefficient configurations (e.g., too many ACLs applied to interfaces). The `show processes cpu` command is often the first step in troubleshooting performance issues, as it pinpoints the offending process.

Alternatives include `show processes cpu history` for a graphical view of CPU trends, `show processes cpu sorted` for a sorted list, and `show processes cpu | include <process>` to filter specific processes. In the broader workflow, after identifying a high-CPU process, an engineer would use `show ip route`, `show ip ospf neighbor`, or `debug` commands to drill down. The command runs in privileged EXEC mode (enable) and does not affect the running configuration.

Output can be lengthy, so it is often piped to `include` or `section` for readability. The command is available in all IOS versions, including IOS-XE, and its output format is consistent, though newer versions may include additional fields like platform-specific processes. Understanding this command is vital for CCNA and CCNP candidates, as CPU issues are common in network exams and real-world scenarios.

Syntax·Privileged EXEC

show processes cpu

When to Use This Command

Troubleshooting high CPU utilization causing network latency or packet drops.
Identifying a specific process (e.g., routing protocol, SNMP) that is consuming excessive CPU cycles.
Monitoring CPU usage over time to detect abnormal spikes or gradual increases.
Verifying the impact of configuration changes or new features on CPU performance.

Command Examples

Basic CPU utilization overview

show processes cpu

CPU utilization for five seconds: 8%/2%; one minute: 7%; five minutes: 6%
 PID  Runtime(ms)  Invoked      uSecs   5Sec   1Min   5Min  TTY  Process
   1           0          1          0  0.00%  0.00%  0.00%    0  Chunk Manager
   2        1234       5678        217  0.20%  0.15%  0.12%    0  Load Meter
   3           0          2          0  0.00%  0.00%  0.00%    0  OSPF Hello
   4       56789      12345       4599  5.00%  4.50%  4.00%    0  IP Input
   5         100        200        500  0.01%  0.01%  0.01%    0  ARP Input
   6        5000       1000       5000  0.50%  0.40%  0.35%    0  SNMP Engine

First line shows overall CPU utilization: 8% total, 2% interrupt overhead. '5Sec', '1Min', '5Min' columns show per-process CPU usage over those intervals. 'Runtime(ms)' is total CPU time used since boot, 'Invoked' is number of times process ran, 'uSecs' is average microseconds per invocation. High '5Sec' values indicate current CPU hogs.

Sorting by CPU utilization

show processes cpu | include ^CPU|IP Input|OSPF|BGP

CPU utilization for five seconds: 45%/5%; one minute: 40%; five minutes: 35%
   4      567890     123456       4599 25.00% 22.00% 20.00%    0  IP Input
   7      123456      78901       1567 10.00%  8.00%  7.00%    0  OSPF Router
   8      234567      34567       6789  5.00%  4.00%  3.00%    0  BGP Router

Filtered output shows only processes of interest. High CPU in IP Input may indicate traffic spikes or attacks; OSPF/BGP high CPU could mean route flapping or neighbor issues.

Understanding the Output

The first line shows overall CPU utilization: 'five seconds' is the current snapshot (total%/interrupt%), 'one minute' and 'five minutes' are rolling averages. The table lists each process with PID, runtime (total CPU time in milliseconds since boot), invoked count, average microseconds per invocation, and CPU percentages over 5 seconds, 1 minute, and 5 minutes. TTY column shows terminal association (0 for system processes).

High '5Sec' values (e.g., >50%) indicate immediate CPU hogs; sustained high '1Min' or '5Min' suggest chronic issues. Watch for processes like 'IP Input' (high traffic), routing protocols (flapping), or 'SNMP Engine' (excessive polling). Interrupt overhead (second percentage in first line) above 10% may indicate hardware issues or high packet rates.

Configuration Scenarios

Identify a process causing high CPU utilization

A network engineer notices that the router's CPU is consistently above 90%, causing slow management access and intermittent routing updates. The goal is to identify which process is consuming the CPU and take corrective action.

Topology

R1---Internet

Steps

1.Step 1: Access the router via SSH or console and enter privileged EXEC mode: Router> enable
2.Step 2: Run the command to view CPU utilization: Router# show processes cpu
3.Step 3: Observe the output. Look for processes with high five-second CPU utilization (e.g., >50%). Common culprits include 'IP Input', 'OSPF Hello', 'SSH', or 'SNMP ENGINE'.
4.Step 4: If a specific process like 'OSPF Hello' is high, check OSPF neighbor stability: Router# show ip ospf neighbor
5.Step 5: If 'IP Input' is high, investigate incoming traffic: Router# show interfaces | include line protocol|rate
6.Step 6: Take corrective action, such as adjusting OSPF timers, applying ACLs to filter unwanted traffic, or upgrading hardware.

Configuration

! No configuration is changed by this command. Example corrective action for OSPF flapping:
Router(config)# router ospf 1
Router(config-router)# timers throttle lsa 100 200 300
Router(config-router)# end

Verify: Re-run 'show processes cpu' and verify that the CPU utilization for the previously high process has decreased. Expected output shows the process now within normal range (e.g., <10% in five-second column).

Watch out: A common mistake is to focus only on the five-second average; the one-minute and five-minute averages provide a better trend. Also, some processes like 'K5 Timer' may appear high but are normal for certain platforms.

Monitor CPU usage during a network attack

A router is experiencing a denial-of-service (DoS) attack, causing high CPU and dropped packets. The engineer needs to quickly identify the attack vector and mitigate it.

Topology

R1---Attacker---Internet

Steps

1.Step 1: Enter privileged EXEC mode: Router> enable
2.Step 2: Run the command: Router# show processes cpu
3.Step 3: Look for processes like 'IP Input' or 'ARP Input' showing very high CPU (e.g., >80%). This indicates a flood of packets.
4.Step 4: Use 'show interfaces' to identify which interface is receiving the most traffic: Router# show interfaces GigabitEthernet0/0
5.Step 5: Apply a temporary ACL to block the attack source: Router(config)# access-list 100 deny ip host 192.168.1.100 any Router(config)# interface GigabitEthernet0/0 Router(config-if)# ip access-group 100 in
6.Step 6: Verify the ACL is working: Router# show access-lists 100
7.Step 7: Re-check CPU: Router# show processes cpu

Configuration

! ACL to block a specific source:
Router(config)# access-list 100 deny ip host 192.168.1.100 any
Router(config)# access-list 100 permit ip any any
Router(config)# interface GigabitEthernet0/0
Router(config-if)# ip access-group 100 in

Verify: After applying the ACL, 'show processes cpu' should show reduced CPU for 'IP Input'. The five-second average should drop below 50%.

Watch out: Be careful not to block legitimate traffic. Use 'show processes cpu history' to see if the spike correlates with the attack. Also, remember that ACLs consume CPU themselves, so excessive ACLs can worsen the problem.

Troubleshooting with This Command

When using `show processes cpu` for troubleshooting, a healthy router typically shows CPU utilization below 50% in all three averages, with most processes using less than 1% each. Problem indicators include sustained high utilization (e.g., >80% in the five-minute average) or a single process consuming the majority of CPU. Key fields to focus on are the five-second, one-minute, and five-minute averages in the header, and the 'CPU utilization for five seconds' line.

In the process list, pay attention to the '5Sec' column (CPU percentage in the last five seconds) and the 'Runtime(ms)' column (total CPU time consumed since boot). Common symptoms: if 'IP Input' is high, the router is receiving a high rate of packets that need process switching (e.g., broadcast, multicast, or packets requiring ACL inspection). If 'OSPF Hello' is high, OSPF neighbors may be flapping.

If 'SSH' or 'Telnet' is high, excessive management sessions may be open. A step-by-step diagnostic flow: 1) Run `show processes cpu` and note the top processes. 2) If a routing protocol process is high, check neighbor states with `show ip ospf neighbor` or `show ip eigrp neighbors`. 3) If 'IP Input' is high, use `show interfaces` to check for input errors, broadcasts, or high packet rates. 4) Use `show processes cpu history` to see if the spike is recent or persistent. 5) Correlate with `show logging` for any error messages. 6) If necessary, use `debug` commands cautiously (e.g., `debug ip packet` with an ACL to limit output) to see what packets are being process-switched. Always remember that high CPU can also be caused by hardware issues like faulty interfaces or line cards.

The command is non-disruptive and can be run repeatedly. For persistent issues, consider upgrading hardware or optimizing configurations (e.g., using CEF, summarizing routes, or tuning routing timers).

CCNA Exam Tips

CCNA exam may ask which process is causing high CPU; look for 'IP Input' or routing protocol processes.

Remember that the first line shows total CPU and interrupt overhead; interrupt overhead above 10% often indicates a hardware or Layer 1 issue.

The '5Sec' column is the most immediate indicator of current CPU usage; '1Min' and '5Min' show trends.

Know that 'show processes cpu' is used for real-time troubleshooting, while 'show processes cpu history' shows graphical historical data.

Common Mistakes

Mistake 1: Confusing total CPU with interrupt overhead; the first line shows 'total%/interrupt%'.

Mistake 2: Ignoring the '5Min' column; a process with high '5Sec' but low '5Min' may be a transient spike.

Mistake 3: Using this command without filtering when looking for a specific process; use '| include' to narrow down.

show processes cpu vs clear logging

Both are privileged EXEC commands used in troubleshooting, but show processes cpu diagnoses CPU performance issues by displaying process-level utilization, while clear logging resets the syslog buffer to clear old messages for fresh log capture.

Aspect	show processes cpu	clear logging
Scope	All processes and CPU utilization	Syslog buffer in memory
Effect	Displays statistics	Deletes all log messages
Impact	Read-only, no impact	Destructive, removes log history
Persistence	Information persists until next show	Logs cleared immediately, not recoverable
Typical use	Identify high CPU processes	Clear logs before a test or to free buffer

Use show processes cpu when experiencing high CPU or performance issues to identify the offending process.

Use clear logging when you need to reset the logging buffer for a clean troubleshooting session or to free memory.

Platform Notes

In IOS-XE (e.g., Catalyst 9000 switches), the `show processes cpu` command works similarly but may include additional platform-specific processes like 'IOSXE-RP Punt' or 'IOSXE-IP Punt'. The output format is largely the same, but the header may show 'CPU utilization for five seconds: X%/Y%' where Y% is the total CPU capacity. In NX-OS (e.g., Nexus switches), the equivalent command is `show system resources` or `show processes cpu` (though syntax may vary).

Specifically, on NX-OS, use `show processes cpu` to see per-process CPU, but the output is different: it shows 'PID', 'Process', '5Sec', '1Min', '5Min', and 'Status'. On ASA firewalls, the command is `show processes cpu-usage` or `show cpu usage`. In IOS-XR (e.g., ASR 9000), the command is `show processes cpu` but the output is more detailed, including per-node statistics.

For IOS versions, the command has remained consistent from 12.x to 16.x, though newer versions may add fields like 'Invoked' count. In IOS 15.x and later, the output may include a 'Platform' section for hardware-specific processes. Always check the specific platform documentation, as some low-end routers may not support all parameters.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions