High CPU Utilization in Exec and Virtual Exec Processes

router#show process | i CPU|Exec
CPU utilization for five seconds: 0%/0%; one minute: 0%; five minutes: 0%

The amount of data transferred through each vty session can be verified with
the show tcp command:
router#show tcp vty 0

Preventing Processes from Hanging
Process Watchdog 


What the Process Watchdog does is monitors the router’s processes and if
one is determined to have hung, it carries out a pre-determined action.

There are several modes that the Process Watchdog can be set to.
These different modes are: normal, hang, reload, terminate. 

Now that you know the various modes, you can pick a mode and then
type this command to initiate the Process Watchdog.
To run the command type:


To prevent a process from wedging on the CPU, we use the following
command: 
scheduler process-watchdog.

There are four options to this command:


1. scheduler process-watchdog hang

This will keep the process in the process table,
but will no longer schedule it on the CPU.


2. scheduler process-watchdog normal

This is the "default" behaviour as decided by the developers.
The result is difficult to predict unless you have access to
the source code.


3. scheduler process-watchdog reload

This will reload the router. While this may seem a bit harsh,
keep in mind that the loss of certain processes (e.g. IP Input)
will all most certainly leave the router in an unusable state.
In this case it would be better to reload.


4. scheduler process-watchdog terminate

This choice will result in the termination of the process and the
continued operation of the router. However, as noted above, the loss
of some key process is certain to have an adverse affect on the router.


Allowing the scheduling of lower priority processes
!
In cases where extremely high network load presents itself on the
inter- face of a router, it is possible that other tasks will not
be able to run. 

By default, the Cisco IOS allocates 5% of the CPU time to the
lower priority tasks.During a high load event, such as a DDOS, this
default may be insufficient to ensure that other tasks acquire CPU time,
such as routing protocol updates and CEF table maintenance.

To modify the default behaviour, we utilize the scheduler allocate command.
This is a global command, and is used thusly:

scheduler allocate 4000 200

Where 4000 is the maximum number of microseconds to allocate to
fast switching any single network interrupt context.
!
Where 200 is the minimum guaranteed number of microseconds to allocate
to process level tasks while network interrupts are masked.
The defaults are 4000 and 200, as shown above.


Modifying the interval at which statistics are gathered
!
By default, the Cisco IOS gathers statistics for the various counters
at an interval of 300 seconds, or five minutes. While this is suitable
for most states of operation, there may be select periods where a more
granular (or gross) interval is required.

Keep in mind that this does have an effect on the performance of the router,
however.To change the statistics gathering interval, we use the global
load-interval command thusly:

load-interval 300

Where 300 is the number of seconds we wish to use as our interval.
If you set this to some more granular figure (e.g. 30 seconds), remember
to set it back when you have completed your data gathering.
!
!

Memory Leak Bug
A memory leak occurs when a process requests or allocates memory and then
forgets to free (de-allocate) the memory when it is finished with that task.
As a result, the memory block is reserved until the router is reloaded.
Over time, more and more memory blocks are allocated by that process until
there is no free memory available.
Depending on the severity of the low memory situation at this point,
the only option you may have is to reload the router to get it
operational again.

!

(in enable mode) from your Cisco device, you can use Output to display
potential issues and fixes :
show memory allocating-process totals | show memory summary | show technical-support
 
The *Dead* Process
The *dead* process is not a real process. It's there to account for the 
memory allocated under the context of another process which has terminated. 
The memory allocated to this process is reclaimed by the kernel and returned 
to the memory pool by the router itself when required. 
This is the way IOS handles memory.
Router#show memory dead