Average CPU utilization level is above 90. Solving the problem of high CPU utilization on Cisco routers

This article explains common symptoms and causes of high CPU usage in Cisco routers and provides guidance and troubleshooting solutions. This document not limited to specific software and hardware versions.

Symptoms of High CPU Usage

The following are common symptoms high load CPU. If any of the symptoms described above are present, follow the steps in this document to resolve the problem.

• The show processes cpu command gives high value in percent
• Slow work
• Router services do not respond, for example:
  • Telnet response delay or unable to access router via Telnet protocol
  • slow response on console
  • Slow response to ping command or no response at all
  • the router does not send routing updates to other routers

Initial troubleshooting

As soon as any of the above symptoms are noticed, do the following:

• Check for security issues. As a rule, high CPU usage is caused by problems of this kind, such as the functioning of malware(worm or virus) on the network. If latest changes were produced on the network a long time ago, this is the most probable cause high CPU usage. Typically, adding strings to access lists is sufficient to limit the impact of this problem.
• Make sure all debugging commands are disabled in the router by running the command undebug all or no debug all.
• Can execute commands show on the router? If yes, start collecting immediately additional information using these commands.
• Router unreachable? Can you reproduce this issue? If yes, power cycle your router and configure the command before reproducing the problem scheduler interval 500. As a result, low priority processes will be scheduled to run at 500 millisecond intervals, giving time to run some commands even when the CPU is at 100% utilization. On the 7200 and 7500 series, use the command scheduler allocate 3000 1000.
• Is your router showing signs of high CPU usage for brief and unpredictable periods? If yes, collect command output regularly show processes cpu, which display the reason for the high CPU usage if it is caused by interrupts or an individual process.
• Finding out the causes and solving the problem

Use the command show processes cpu to determine whether high CPU usage is caused by interrupts or processes.

High CPU load by processes

Identify the process that is using excessive CPU. Unusual activity, which is specific to the process, results in an error message in the log. So the output of the command is show logging exec should be checked first for any errors related to a process using a large number of CPU cycles.

Debugging is also very useful in troubleshooting the problem of high CPU usage by processes. However, debugging should be done very carefully as it may result in even higher CPU usage. Debugging will be safe and effective if the following prerequisites are met:

• All logs, except the buffer information log, must be disabled or the severity level of the information logged in them must be lowered from 7 (debug) to 6 (informational) or lower using the appropriate configuration command logging destination [ importance level ] . Information about enabled logs and the severity levels of the information logged is contained in the header lines of the command output show logging exec.
• The size of the logging buffer needs to be increased to accommodate all necessary information. For more information, see the global configuration command logging buffered.
• To make debugging easier to read and understand, you should include millisecond timestamps as well as the date and time. Additional information see global configuration command description service timestamps.

Commands for more information

These commands provide additional information about the problem:

• show processes cpu
• show interfaces
• show interfaces switching
• show interfaces stat
• show ip nat translations
• show align
• show version
• show log

If your router is completely inaccessible, turn it off and on first. Then periodically collect the output of the above commands, except for the command show log, the results of which must be logged on the server syslog. Output data should be collected at 5 minute intervals. Data collection can also be done using HTTP or SNMP.

show processes cpu command

This is an example command header show processes cpu:

CPU utilization for five seconds: X%/Y%; one minute: Z%; five minutes: W% PID Runtime(ms) Invoked uSecs 5Sec 1Min 5Min TTY Process

The following table describes the fields of this header:

¹Process level CPU usage = X - Y
²The values ​​correspond not to an arithmetic mean, but to an exponentially decaying mean, so the latter values ​​have a greater influence on the calculated mean.

Note: Total CPU usage should not be interpreted as an indication of the router's switching ability larger number packages. In Cisco 7500 routers, the generic interface processors (VIPs) and routing and switching processors (RSPs) do not report linear CPU usage. Almost half of the switching power in packets per second is realized after 90-95% CPU utilization.

show interfaces switching command

This command is used to determine the active switch paths on interfaces

The following is an example of the output of the show interfaces switching command for one interface:

RouterA#show interfaces switching

The output lists the switching paths for all protocols configured on the interface, so you can easily see the type and amount of traffic passing through the router. The following table describes the output fields.

show interfaces stat command

This command is a combined version of the show interfaces switching command. Below is an example of the output for one interface:

RouterA#show interfaces stat

Command Output show interfaces stat differ between platforms: they depend on the available and configured switch paths.

show ip nat translations command

The show ip nat translations command is used to display active translation translations on the router network addresses(NAT). Each active broadcast generates CPU interrupts and affects the router's overall CPU usage. A large number of broadcasts can affect the performance of the router.

The following is an example of the output of the show ip nat translations command:

router#show ip nat translations Pro

show align command

This command is only available on platforms based on reduced instruction set RISC processors. On these platforms, the CPU can correct alignment misalignments for memory reads and writes. Below is an example of the output:

Alignment data for:
4500 Software (C4500-DS40-M), Version mis-aligned RELEASE SOFTWARE (fc1)
Compiled Tue 31-Mar-98 15:05 by jdoe

Total Corrections 33911, Recorded 2, Reads 33911, Writes 0

Initial Initial
Address Count Access Type Traceback
40025F4D 15561 16bit read 0x606F4A7C 0x601C78F8 0x6012FE94 0x600102C0
40025F72 18350 32bit read 0x606FB260 0x6013113C 0x600102C0 0x60010988

show version command

In order to track high CPU usage issues, an important part of the output of this command is the Cisco IOS software version, platform, CPU type, and router uptime. Click this link to view detailed description show version commands.

show log command

This command displays the contents of buffer information log messages.

Any questions?
Contact Aquilon-A to find out more details and get exactly what you need.

Svchost.exe (service host) – file and process of operating systems Windows family. Its task is to load and execute internal services from dynamic link libraries (files with the .dll extension), ensuring the functionality of almost all components operating system. Figuratively speaking, svchost.exe is the liver, kidneys and light Windows, without which its existence is unthinkable. But why do these “vital organs” sometimes create so many problems for us?

Today we’ll talk about what to do if svchost.exe loads the processor, preventing you from working normally on your computer.

Reasons why the system is loaded by the svchost process

Since svchost.exe handles a significant portion of system services, there can be many reasons for heavy CPU load. Here are the most common ones:

• Viral infection.
• Too much network congestion, for example, with many open slots in uTorrent.
• Errors in device drivers (sound, network, etc.), since the latter closely interact with system services.
• Damage to operating system files (in particular, the service host itself and various dynamic libraries).
• System service errors.
• PC hardware malfunction.

Sometimes this happens as a result of an unsuccessful pirate campaign. Windows activation(not all activators are equally useful) and hacking programs.

How to determine which service is loading the service host

To view the services running in the loading host process, the built-in or alternative task manager is suitable. In the first, the information we are interested in is contained in the section “ ProcessesWindows" Each host process is listed under the name " Service node».

The green frame in the screenshot shows the list of services of one svchost process.

As an alternative to the stock task manager, I prefer the free one from Sysinternals. In it, just hover the cursor over a line - and all the necessary information will be displayed in a pop-up window.

If there is more than one service running in the loading host process, you will have to brute-force to find the one that is causing the problem:

• Open the application " Services"(the open button is located at the bottom of the task manager tab of the same name).

• Disable the first service from the list of loading service host: open its properties through the right-click menu and select from the list " Startup type» « Manually" or " Disabled».

• Reboot your computer. If the problem persists, start this service again and disable the next one.

A problematic service has been detected, what next?

Then act according to the situation. If the failure is caused by a minor component, e.g. Superfetch(quite often creates a problem for Windows 8 and 10 users), just leave it disabled. If the service is related to hardware (audio, network, etc.), try updating or rolling back the device driver. If you have problems with Update CenterWindows(often found on G7s and XP), in 90% of cases disabling the update check helps. However, a complete refusal to install system updates is a big gap in Windows security, so it's better to switch it to manual mode.

If svchost started to load the processor after installation Windows updates, applications or drivers, or uninstall the source of the crash.

In some cases, cleaning the folder helps \Windows\Prefetch where the Prefetcher trace files are stored – system component, which speeds up the loading of the system and programs.

How to unload the network

Too much network load, errors network driver, failures of applications that use the Internet, network viruses (worms), become the source of the problem, perhaps, in half of the cases. To check this version, disable the network adapter in Device Manager and restart your PC. If the load on the processor has returned to normal, the cause has been found, all that remains is to find the culprit.

Reduce CPU load network components helps:

• reducing the number of simultaneous downloads and distributions of torrents;
• prohibiting access to the Internet for programs for which this is not necessary (especially if there are many of them);
• shutdown network programs when they are not in use;
• cleaning temporary folders (temp) – they may contain incompletely downloaded files that downloading applications are trying to download to the end;
• antivirus scanning for network worms;

Another "disease" quite for a long time was tormented by Windows 7. With it, the CPU load of the svchost process reached 100% and decreased only when the network was turned off. The reason lay in the uncontrolled “reproduction” of virtual tunnel adapters Microsoft 6to4, of which sometimes several hundred were created.

To check if this is your case, open the device manager, go to the " View" and check the box " Show hidden devices " Next, expand the list of network adapters. All "Microsoft 6to4" clones, if any, are located there.

To fix the problem, just delete the extra copies virtual adapters. This can be done either manually one at a time or automatically – all at once. For automatic deletion You will need a console utility, which is available for download on the MSDN Microsoft website.

After unpacking devcon to hard drive run as administrator command line and follow the instructions C:\devcon.exe remove *6to4*(instead of C:\, specify your path to devcon.exe). To prevent this from happening again, update your operating system.

Today, the problem with 6to4 adapters has already been fixed by developers and occurs only in those who do not install Windows updates.

What if it's a virus? How to distinguish a malicious svchost from a normal one

The malware can:

• Create a copy of yourself on your hard drive under the name svchost.exe, which will be located anywhere except in the directory \Windows\System32, since it contains the same name system file. That is, to disguise itself as a system process.
• Inject your dynamic libraries into one of the legitimate host processes.
• Modify (patch) the svchost.exe system file by placing your own executable code in its body.

Some users are afraid of what they consider to be too many running host processes. In fact, this indicator does not mean anything bad. Number svchost processes in a normally operating system it is 8-9 or more. Each of them runs one or more services - this can be seen in the task manager. Services are divided into groups depending on the level of access to resources they need, so there are several processes.

Most normal host processes run on behalf of the system, network service, and local service. To Windows release 8, any host service launched on behalf of the user was automatically recognized as a virus, but now this is only true for Windows 7 and its predecessors. In G8 and 10, one service host working on behalf of the user is the norm.

The fact that the host process is running or being used by a virus is indicated by at least one of the following signs:

• The host process file is NOT in the folder \Windows\System32.
• The process is running an unknown service or has a non-system library (.dll) loaded into it.

• On Windows XP-7 the host process is running on behalf of the user, and on Windows 8-10 there is more than one host process on behalf of the user.
• The Parent process of a normal service host is always the Services.exe application. When infected with a virus, anything can happen instead.

The screenshots show ProcessExplorer, running as administrator. To view the list of .dlls loaded into the service host, select the last one with a mouse click and press Ctrl+D on the keyboard. To find out its parent process, click the " Properties" V top panel programs and open the “ Image».

What to do if svchost.exe is infected with a virus

It is important to figure out where exactly the infection is hiding: in the system file svchost.exe itself or in the one that uses it. If a system file is infected, do not delete it under any circumstances, but replace it with a clean one, taking it from a similar copies of Windows(to do this you will have to boot the computer from another medium). Malicious libraries, on the contrary, must be completely removed.

How to check system files for errors

Most of the dynamic libraries from which the service host loads services are own files Windows, less - device driver components. The console utility sfc.exe can help fix system file errors.

Run the command line as administrator and follow the instructions sfc/scannow. The /scannow parameter means: “immediately scan and replace all damaged files from a cached copy."

The results will be shown after the test is completed in the same window.

What to do if nothing helps

In quite rare cases, 100% CPU load of svchost.exe is not eliminated even reinstalling Windows. The culprits in such situations are faulty drivers or even the devices themselves - network adapters, audio codecs, RAM (the latter's errors sometimes manifest themselves in very bizarre ways) or something else. There have been cases when the problem was solved by the computer.

If suspicion falls on the equipment, first of all try to completely reinstall all drivers, using the stable versions. Check the devices by turning them off one by one - in the BIOS or, if possible, physically. If you find the source of the problem, replace or repair the problem unit.

Also on the site:

Working on a personal computer requires quite a lot of effort from the user. But this is only if the main goal is to create a productive device. If your PC is slow, this could be due to a variety of reasons.

One of the most common options is CPU overload. If the user begins to analyze the current situation, he may note that the fault lies with completely incomprehensible applications and running processes.

Strange central process loading is a problem that many users face. This also applies to the most modern processors. Therefore, it is necessary to look for a reason other than outdated equipment.

In some situations, you can reinstall the operating system. Another popular method is to update and install necessary drivers. This real problem must be dealt with using effective techniques.

Finding out the reasons

The relevance of this issue is very great. Users need to first find out which program is to blame for such a negative situation. This problem is quite common, so many users are interested in it.

To assess the degree of CPU overload, you need to open the task manager. After that, go to the tab with all applications that are running on the personal computer. Next, all objects are sorted according to certain parameters. You can do this by name or by load produced.

The problem can occur even when the user has closed the application, but it is still in the active list. As a result, they load the system. And the user may not even be aware of this, since he is sure that he closed the program or game.

If crashes start, you can reboot personal computer. In some cases, this helps, since in this way the downloaded programs will still be closed. You can also use the task manager. With its help, you can close all the necessary objects even faster.

At the time of processing the result of all displayed processes in the download, the user should conduct an analysis. Some applications may be dangerous. If they are not eliminated in time, users will experience a gradual or sudden decrease in device performance.

Professional help

A situation may arise when all programs are closed, but the CPU load is quite high. Such situations are also not uncommon. In this matter you cannot do without the help of specialists. It is not at all necessary to take the device to the specialist. You can use the Process Explorer utility.

The application will help you see everything hidden downloads. As soon as the list appears on the screen, you can sort out unnecessary services. You should also identify whether there are any suspicious objects in the device. This is what you need to use for this software product, since the Task Manager is not always able to display all elements.

Active struggle

Most common cause The problem that arises is the lack of necessary drivers. Users need to boot the device using safe mode. Immediately after this, you can assess whether there is a load on the processor or whether there is no such problem.

In most cases, the reason lies precisely in the drivers. The most the right way is to reinstall the OS. It is better to entrust such actions to a specialist. Only after installing the system should you carefully download drivers. These components must be installed one at a time.

Users need to act very carefully. It is better to download directly from the official website of the manufacturer of your device. In this case, the risk of problems occurring is reduced to zero.

In second place are viruses. It is these pests that can negatively affect the operation of the processor. Some of these objects can extract files. Also, pests simply steal personal data and other important components. The appearance of banners is also the influence of malicious software.

Fixing the problem is a very simple process. All you need to do is install a high-quality antivirus service. First of all, it will begin the process of scanning the system. Efficient utility able to identify all pests different types and types. Afterwards, you can eliminate all threats and begin to eliminate problems that arose due to viruses.

Device performance may also be slower if the HDD operation. It is important to ensure that the hard drive operates exclusively in DMA mode. Any other option will lead to all sorts of problems and failures.

You can also check the impact of all connected objects. To do this, simply disconnect the mouse, flash drive, if it is a laptop. If work is carried out with desktop computer, then the user must also turn off the monitor and keyboard.

You should pay attention to the Device Manager. If some devices display yellow or red icons, this may mean incorrect operation or lack of drivers. So users need to mandatory study all the displayed information.

Based on this, conclusions can be drawn about the state of each element. So you can download immediately missing drivers or update outdated versions. If necessary, users can entrust some problems to real experts, who will certainly help solve all problems professionally.

Another common reason is the presence of dust and dirt. Some users do not keep their device clean. Therefore, the result of such negligence is overheating of the device. The cooler starts working much faster just to cool the personal computer.

Also replacing the differential in the operating mode. The device can work either stronger or weaker. Also no exception spontaneous reboot and turning off the PC. Users can fix all these failures themselves.

It is important to constantly monitor the temperature of the device. To do this you should special utility. The application will be able to estimate the optimal performance indicator. When it increases to a critical level, a notification will be shown. So the user needs to immediately identify the cause and try to eliminate it as soon as possible.

Dust cleaning must be done at least twice a year. Each user can do this independently. The thermal paste should also be replaced during the cleaning process. This is a fairly simple process. You should first read or watch a video on this topic.

Each considered problem-solving option is really effective. Users only need to find out the reason to choose the right method. If it is difficult to decide to implement any process, then you can simply reinstall the operating system. It's a win-win.

Overloading the processor of a computer or laptop can be caused by a number of reasons - from technical obsolescence of hardware to viruses that load the system.

High CPU usage in itself is not a problem. All resources can be consumed when launching games, ultra-high quality videos, video editing applications, archivers, and antivirus checks. First of all, you need to check whether the processor is really overloaded or the cause slow work there were other problems.

Press Ctrl+Shift+Esc to open Task Manager and click on the CPU column to sort. You can also get to the dispatcher by pressing Ctrl+Alt+Del and selecting the desired item in the menu that appears.

Normally, a task list should look something like this. When the load is high, one or more tasks will consume most of the CPU time. If one of the applications takes 50-100% of its power constantly, this may be a symptom of a problem.

For example, in the screenshot, almost half the power of the i5-2500k processor is occupied by the “Task Manager” and system interrupts, which should not be the case.

Hardware causes of overload

Despite common misconception, it is rarely the cause of CPU overload. The processor is more likely to cause the system to reboot or freeze completely than to for a long time operate at 100% power. However, such cases sometimes occur and the user needs to know how to protect themselves from them.

Outdated equipment

The most common cause of processor overload is an aging PC or laptop. Software does not stand still: if five years ago for a comfortable Google work Chrome needed a single-core processor with a couple of hundred megabytes RAM, then now several heavy tabs can use the resources of several cores and several gigabytes. In 2018, for comfortable work you will need a 4-core processor with 6-8 gigabytes of memory.

If you don’t have money for new hardware, try to follow these tips:

• Don't run multiple applications at once. This not only makes it difficult for the processor in itself, but RAM that is filled to capacity creates additional load;
• If possible, use older versions of programs. Yes, it may be inconvenient and unsafe, but older versions of applications will be much less demanding;
• disable unnecessary services and programs in startup. This can be done in the “Startup” and “Services” tabs of the “Task Manager”;
• try to avoid situations in which the processor will be loaded at 100% unnecessarily. For example, don't open many browser tabs or 4K videos on a small laptop screen.

Overclocking

The next situation that can cause overload is overclocking or overclocking. There is nothing wrong with overclocking the characteristics of devices in itself; all major manufacturers provide programs for adjusting the operating frequencies of the processor and video card. However, exceeding processor limits may result in:

• overheating;
• image artifacts;
• errors and application crashes;
• freezing;
• 100% CPU load for trivial tasks.

Here, to check, you should use diagnostic utilities that record the results in the log. For detailed statistics MSI Afterburner is suitable for all components.

CPU overheating

On my own high temperature It rarely causes overload directly; more often it causes the processor to fail or triggers mechanisms that reduce the frequency and voltage on the device to protect it. You can look at the sensors in AIDA64.

How to solve the overheating problem?

• clean the case system unit from dust. Pay special attention to the heatsink and processor fan. For a laptop, the cleaning procedure should be carried out at least once every one and a half to two years;
• If the computer has been in use for two years or more, remove the thermal paste between the fan and the processor cover. Apply the new one in an even layer;
• if standard cooling cannot cope or the cooler does not work, replace it with a more powerful one. Preferably with a massive aluminum radiator with copper tubes;
• Do not block the ventilation holes of the system unit when installing it in place.

Pay attention! Normal temperature working processor - about 40 degrees, at 70-80 the BIOS protection mechanisms are activated.

Software causes of overload

It is much easier to get 100% CPU load using software than using hardware - you just need to make a mistake in the antivirus scan settings or download an incompatible one. new system program.

Antiviruses and viruses

From the whole list of reasons possible problems, leading to 100% CPU load, most often problems arise with antiviruses. Real-time file checks are a resource-intensive task that, when incorrect settings may take forever.

On weak computers Installing a cloud antivirus like Panda Cloud Cleaner will help. It is much more demanding on the quality of the Internet, but the load on the processor is minimal.

In Windows 10, you can use the built-in Defender, which is quite sufficient for home tasks.

The other side of the coin is viruses on an unprotected PC. Malicious programs can use your computer for mining or as a gateway for DDOS attacks. For one-time cleaning of existing problems, use the Dr.Web Cureit utility!

Automatic update

Overload may be caused by failed update operating system or drivers. Such problems occurred in 2015 for users of beta versions of Windows 10. To solve the problem, try installing different versions drivers, roll back updates via a system restore point or disable them completely.

In Windows 10, disabling updates has no visible effect on overload protection.

Background applications

A number of programs to support their functionality work in background. For example, Skype and LibreOffice are permanently in RAM, for fast loading. In some situations, this can become a problem - for example, when a program hangs in the background and takes up half or all of the computer's resources.

Disable background application can also be found in the “Task Manager” if you hover your mouse cursor over the selected running application and use the “Cancel task” button.

Video - CPU utilization 100 percent, what to do on Windows 7,8,10?

Increased load on CPU causes slowdowns in the system - applications take longer to open, data processing time increases, and freezes may occur. To get rid of this, you need to check the load on the main components of the computer (primarily the CPU) and reduce it until the system works normally again.

The central processor is loaded with open heavy programs: modern games, professional graphic and video editors, server programs. After finishing working with heavy programs, be sure to close them rather than minimize them, thereby saving your computer resources. Some programs may run in the background even after being closed. In this case, they will have to be closed through "Task Manager".

If you don't have any enabled third party programs, but goes to the processor high load, then there may be several options:

• Viruses. There are many viruses that do not cause significant harm to the system, but at the same time heavily load it, making regular work difficult;
• “Clogged” registry. Over time, the operating system accumulates various bugs and junk files, which large quantities can create a significant load on PC components;
• Programs in "Startup". Some software can be added to this section and loaded without the user’s knowledge along with Windows (the greatest load on the CPU occurs precisely during system startup);
• Accumulated dust in the system unit. By itself, it does not load the CPU, but can cause overheating, which reduces the quality and stability of the central processor.

Also try not to install programs that are not suitable for your computer. system requirements. Such software can work and launch relatively normally, but at the same time it has maximum load on the CPU, which over time greatly reduces the stability and quality of work.

Method 1: Cleaning Task Manager

First of all, look at which processes take up the most resources from your computer, and if possible, disable them. The same should be done with programs that are loaded along with the operating system.

Do not disable system processes and services (they have a special designation that distinguishes them from others) if you do not know what function they perform. It is recommended to disable only user processes. You can disable a system process/service only if you are sure that this will not lead to a system reboot or black/blue screens of death.

Instructions for disabling unnecessary components look like this:

Also via "Task Manager" needs to be cleaned "Startup". You can do it like this:

Method 2: Cleaning the Registry

To clear the registry from broken files, you just need to download special software, for example, . The program has both paid and free versions, completely Russified and easy to use.

Method 3: Virus Removal

Small viruses that load the processor, masquerading as various system services, are very easy to remove using almost any high-quality antivirus program.

Let's look at cleaning your computer from viruses using an antivirus as an example:

Method 4: Clean your PC from dust and replace thermal paste

Dust itself does not load the processor in any way, but it can become clogged with the cooling system, which will quickly cause overheating of the CPU cores and affect the quality and stability of the computer. To clean, you will need a dry cloth, preferably special wipes for cleaning PC components, cotton swabs and a low-power vacuum cleaner.

Instructions for cleaning the system unit from dust look like this: