Use Processes Commands to Monitor CPU and Memory

Introduction

This document describes the show processes commands and the detailed statistics provided in the outputs.

---

Prerequisites

Requirements

There are no specific requirements for this document.

---

Components Used

The commands described in this document are not limited to a specific hardware platform or software release. The examples are based on:

• Cisco IOS and Cisco IOS XE Software Release

---

---

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.

---

Conventions

For more information on document conventions, refer to the Cisco Technical Tips Conventions.

---

Background Information

The show processes command displays information about active processes on a device. Run the show processes cpu command to display detailed central processing unit (CPU) utilization statistics for these processes, and run the show processes memory command to display the amount of memory the processes use.

---

show processes Command

This is a sample output of the show processes command:

Router#show processes    
CPU utilization for five seconds: 0%/0%; one minute: 0%; five minutes: 0%
 PID QTy       PC  Runtime (ms)    Invoked   uSecs    Stacks TTY Process
   1 Cwe 5623C0A7AD64             2         10     200  22496/24000  0 Chunk Manager   
   2 Csp 5623BD025A6F         27219      78235     347  10480/12000  0 Load Meter      
   3 Mwe 5623C6484245             0          1       0  46528/48000  0 PKI Trustpool   
   4 Mwe 5623BEF1EF79            20         13    1538  18976/24000  0 RF Slave Main Th
   5 Mwe 5623BB806DF5             0          1       0  22400/24000  0 Retransmission o
   6 Mwe 5623BB8074A5             0          1       0  22272/24000  0 IPC ISSU Dispatc
   7 Mwe 5623C47286C5             0          1       0  94096/96000  0 EDDRI_MAIN      
   8 Mwe 5623C09EA4A5             0          1       0  22384/24000  0 RO Notify Timers
   9 Lst 5623C0AA3859        210829      59533    3541  21840/24000  0 Check heaps     
  10 Cwe 5623C0A9851E          1336       6521     204  22400/24000  0 Pool Manager    
  11 Mwe 5623C0A987E5             0          1       0  22480/24000  0 DiscardQ Backgro
  12 Mst 5623BF27E399             0          2       0  22368/24000  0 Timers          
  13 Mwe 5623BF2FC6D5             7        295      23  10560/12000  0 WATCH_AFS       
  14 Mwe 5623B8A1A0E5             1          9     111  22144/24000  0 ARP Input       
  15 Mwe 5623B8A13A15         10594     408057      25  22352/24000  0 ARP Background

---

This table lists and describes the fields in the show processes command output.

Field	Description
CPU Utilization for Five Seconds	CPU utilization for the last five seconds. The second number indicates the percent of CPU time spent at the interrupt level.
One <inute	CPU utilization for the last minute.
Five Minutes	CPU utilization for the last five minutes.
PID	Process ID
Q	Process queue priority. Possible values: C (critical), H (high), M (medium), L (low).
Ty	Scheduler test. Possible values: * (that currently runs) E (waits for an event) S (ready to run, voluntarily relinquished processor) rd (ready to run wake up conditions have occurred) we (waits for an event) sa (sleeps until an absolute time) si (sleeps for a time interval) sp (sleeps for a time interval (alternate call) st (sleeps until a timer expires) hg (hung; the process does not execute again) xx (dead: the process has terminated, but has not yet been deleted)
PC	Current program counter.
Runtime (ms)	CPU time the process has used, in milliseconds.
Invoked	Number of times the process has been invoked.
uSecs	Microseconds of CPU time for each process invocation.
Stacks	Stack-space low water mark and total stack space, shown in bytes as low-water mark/total.
TTY	Terminal that controls the process.
Process	Name of process. For more information, refer to the Processes section of this document

---

Note: Because the network server has a 4000-microsecond clock resolution, runtimes are considered reliable only after a large number of invocations or a reasonable measured runtime.

---

show processes cpu Command

The show processes cpu command displays information on the active processes in the router and their CPU utilization statistics. This is a sample output of the show processes cpu command:

Router#show processes cpu
CPU utilization for five seconds: 1%/0%; one minute: 0%; five minutes: 0%
 PID Runtime(ms)     Invoked      uSecs   5Sec   1Min   5Min TTY Process 
   1           2          10        200  0.00%  0.00%  0.00%   0 Chunk Manager    
   2       27228       78266        347  0.00%  0.00%  0.00%   0 Load Meter       
   3           0           1          0  0.00%  0.00%  0.00%   0 PKI Trustpool    
   4          20          13       1538  0.00%  0.00%  0.00%   0 RF Slave Main Th 
   5           0           1          0  0.00%  0.00%  0.00%   0 Retransmission o 
   6           0           1          0  0.00%  0.00%  0.00%   0 IPC ISSU Dispatc 
   7           0           1          0  0.00%  0.00%  0.00%   0 EDDRI_MAIN       
   8           0           1          0  0.00%  0.00%  0.00%   0 RO Notify Timers 
   9      210898       59553       3541  0.00%  0.03%  0.04%   0 Check heaps      
  10        1337        6523        204  0.00%  0.00%  0.00%   0 Pool Manager     
  11           0           1          0  0.00%  0.00%  0.00%   0 DiscardQ Backgro 
  12           0           2          0  0.00%  0.00%  0.00%   0 Timers           
  13           7         295         23  0.00%  0.00%  0.00%   0 WATCH_AFS        
  14           1           9        111  0.00%  0.00%  0.00%   0 ARP Input        
  15       10596      408217         25  0.00%  0.00%  0.00%   0 ARP Background

---

This next table lists and describes the fields in the show processes cpu output.

Field	Description
CPU utilization for five seconds	CPU utilization for the last five seconds. The first number indicates the total, the second number indicates the percent of CPU time spent at the interrupt level
one minute	CPU utilization for the last minute
five minutes	CPU utilization for the last five minutes
PID	The process ID
Runtime (ms)	CPU time the process has used, expressed in milliseconds
Invoked	The number of times the process has been invoked
uSecs	Microseconds of CPU time for each process invocation
5Sec	CPU utilization by task in the last five seconds
1Min	CPU utilization by task in the last minute
5Min	CPU utilization by task in the last five minutes
TTY	Terminal that controls the process
Process	Name of the process. For more information, refer to the Processes section of this document

---

Note: Because the network server has a 4000-microsecond clock resolution, runtimes are considered reliable only after a large number of invocations, or a reasonable, measured runtime.

---

show processes cpu history Command

The show processes cpu history command displays in ASCII graphical form and displays the total CPU usage on the router over a period of time: one minute, one hour, and 72 hours, displayed in increments of one second, one minute, and one hour. Maximum usage is measured and recorded every second; average usage is calculated on periods over one second.

---

This is a sample output of the one-hour portion of the output:

Router#show processes cpu history


!--- One minute output omitted
 

     6665776865756676676666667667677676766666766767767666566667
     6378016198993513709771991443732358689932740858269643922613
100
 90
 80         *  *                     * *     *  * *  *
 70  * * ***** *  ** ***** ***  **** ******  *  *******     * *
 60  #***##*##*#***#####*#*###*****#*###*#*#*##*#*##*#*##*****#
 50  ##########################################################
 40  ##########################################################
 30  ##########################################################
 20  ##########################################################
 10  ##########################################################
    0....5....1....1....2....2....3....3....4....4....5....5....
              0    5    0    5    0    5    0    5    0    5

               CPU% per minute (last 60 minutes)
              * = maximum CPU%   # = average CPU%


!--- 72-hour output omitted

---

• The Y-axis of the graph is the CPU utilization.

• The X-axis of the graph is the increment within the period displayed in the graph. In this instance, it is the individual minutes of the previous hour. The most recent measurement is on the left end of the X-axis.

• The top two rows, read vertically, display the highest percentage of CPU utilization recorded during each increment.

• In the previous example, the CPU utilization for the last minute recorded is 66%. The router can reach 66% only once for that minute, or it can reach 66% multiple times. The router records only the peak reached during the increment and the average over the course of that increment.

---

show processes memory Command

The show processes memory command displays information on the active processes in the router and the memory used. This is a sample output of the show processes memory command:

router>show processes memory
Total: 106206400, Used: 7479116, Free: 98727284 
 PID TTY  Allocated      Freed    Holding    Getbufs    Retbufs Process
   0   0      81648       1808    6577644          0          0 *Init* 
   0   0        572     123196        572          0          0 *Sched* 
   0   0   10750692    3442000       5812    2813524          0 *Dead* 
   1   0        276        276       3804          0          0 Load Meter 
   2   0        228          0       7032          0          0 CEF Scanner 
   3   0          0          0       6804          0          0 Check heaps 
   4   0      18444          0      25248          0          0 Chunk Manager 
   5   0         96          0       6900          0          0 Pool Manager 
   6   0        276        276       6804          0          0 Timers 
   7   0        276        276       6804          0          0 Serial Backgroun 
   8   0         96          0       3900          0          0 OIR Handler 
   9   0         96          0       6900          0          0 IPC Zone Manager 
  10   0          0          0       6804          0          0 IPC Periodic Tim 
  11   0      17728        484      11156          0          0 IPC Seat Manager 
  12   0        288        136       7092          0          0 ARP Input 

.... 

  90   0          0          0       6804          0          0 DHCPD Timer 
  91   0        152          0       6956          0          0 DHCPD Database 
                                  7478196 Total 

---

Note: Due to the way the show processes memory sorted command is implemented in certain Cisco routers and switches, some devices (such as the Cisco 7304.) It shows the total value as the sum of the processor memory and IO memory, rather than the total of the processor memory as shown by show processes memory.

---

This table lists the fields and descriptions in the show processes memory command output.

Field	Description
Total	Total amount of processor memory.
Used	Amount of processor memory in use.
Free	Amount of processor free memory.
PID	Process ID.
TTY	Terminal that controls the process.
Allocated	Bytes of memory allocated by the process.
Freed	Bytes of memory freed by the process, regardless of which process or system component originally allocated it.
Holding	Amount of memory that is held by a process. This parameter helps you troubleshoot when a memory leak is suspected. If a process consumes memory and its holding value continually increases without stabilizing, a memory leak can be present.
Getbufs	Number of times the process has requested a packet buffer.
Retbufs	Number of times the process has relinquished a packet buffer.
Process	The name of the process. For more information, refer to the Processes section of this document.
Total	Total amount of memory held by all processes.

---

Process Descriptions

The next table explains the individual processes in the show processes, show processes cpu, and show processes memory outputs. This is not an exhaustive list.

Process	Explanation
ARP Input	Handles incoming Address Resolution Protocol (ARP) requests.
BGP I/O	Handles reading, writing, and executing Border Gateway Protocol (BGP) messages.
BGP Scanner	Scans the BGP and main routing tables to ensure consistency (this is a separate process and it can consume significant CPU time.)
BGP Router	Main BGP process that starts when the configuration is fully loaded.
BOOTP Server	The gateway Bootstrap Protocol (BOOTP) server process.
CallMIB Background	Deletes the call history if the call history ages out and gathers call information.
CDP Protocol	Main Cisco Discovery Protocol (CDP) - handles the initialization of CDP for each interface. If incoming packet, monitors the CDP queue and timers, then processes it. If timer event, sends update.
Check heaps	Checks the memory every minute. It forces a reload if it finds processor corruption.
Compute load avgs	Computes the five minute, exponentially-decayed output bit rate of each network interface, and the loading factor of the entire system. The load average is computed with this formula: average = ((average - interval) * exp (-t/C)) + interval where t = 5 seconds and C = 5 minutes, exp (-5/(60*5)) = .983 Computes the load of each interface (one-by-one) and checks the back-up interface load (enables them or shuts them down based on the load.)
*Dead*	Processes as a group that is now dead.
Exec	Handles console exec sessions; has a high priority.
Hybridge Input	Handles incoming transparent bridge packets that slip through the fast paths.
*Init*	System initialization.
IP Background	Called upon when you change the encapsulation (for example, when an interface moves to a new state, an IP address changes, when you add a new Data Exchange Interface (DXI) map, or when some dialer timers expire.) Does the periodic aging of the Internet Control Message Protocol (ICMP) redirect cache. Modifies the routing table based on the status of the interfaces.
IP Cache Ager	Ages the routing cache and heals stale recursive routes. The ager runs once every time interval (once a minute by default) and checks whether a recursive routing change has made the entry invalid. Another function of this ager is ensuring that the entire cache gets refreshed approximately every 20 minutes.
IP Input	Process-switched IP packets.
IP-RT Background	Periodically revises the gateway of the last resort and IP static routes. This process is called on-demand, right after the static routes (which the gateway of last resort is dependent on) have been revised.
ISDNMIB Background	Sends ISDN trap service and deletes the call queue if it ages out.
ISDN Timers	Handles ISDN carrier timer events.
Load Meter	Computes the load average for the different processes every five seconds, and the five minute exponentially-decayed busy time. The load average is computed with this formula: average = ((average - interval) * exp (-t/C)) + interval, where: t = 5 seconds and C = 5 minutes, exp (-5/(60*5)) = .983~= 1007/1024 t = 5 seconds and C = 1 minute, exp (-5/60)) = .920~= 942/1024
Multilink PPP out	Processes multi-link packets that have been queued from fast-switching (outbound half fast-switching.)
Net Background	Performs a variety of network-related background tasks. These tasks must be performed quickly and cannot be blocked for any reason. The tasks that are called in the net_background process (for example, interface dethrottling) are time critical. Executes the "Compute load avgs", "Per-minute Jobs", and "Net Input" processes. Handles the interface when it becomes throttled.
Net Input	Handles otherwise unknown packets. This is done at the process level so that input queue comes into play. If you operate at the interrupt level, you can easily lock up the router. Handles some known protocols you decide to offer to the bridge. In this case, net_input either sends the packet to NULL, or bridges it.
Net Periodic	Performs interface periodic functions every second such as: Resets the periodic counter Clears the input error rate counter Checks serial lines to see if they restart from glitches Performs any periodic keep-alive functions Checks protocol routing table consistency Checks the bridge state consistency that announces line protocol up or down events
Per-minute Jobs	Performs these tasks once a minute: Analyzes stack usage Announces low stacks Executes registered one_minute jobs
Per-second Jobs	Performs a variety of tasks every second; executes registered one_second jobs.
Pool Manager	Manager process manages growth and discards requests from dynamic pools at the interrupt level.
PPP Manager	Manages all PPP Finite State Machine (FSM) operations and processes PPP input packets and interface transitions. Monitors the PPP queue and the PPP timers (negotiation, authentication, idle, and others.)
OSPF Router	Main Open Shortest Path First (OSPF) process.
OSPF Hello	The OSPF process that receives and processes OSPF Hello packets.
*Sched*	The Scheduler.
Serial Background	Watches events and branches to the correct service routine for each expired event (mainly reset of interfaces.)
Spanning Tree	Executes the Spanning Tree Protocol (STP) and handles spanning-tree processing. Monitors the STP Queue: Process incoming STP packets Monitors the STP timers: Hello timer Topology change timers Digital Equipment Corporation (DEC) short age out timer Forward delay timer Message age timer
Tbridge Monitor	Dispatches packets of interest to the appropriate handler ("traffic of interest" is Cisco Group Management Protocol (CGMP), Internet Group Management Protocol (IGMP), OSPF packets [multicasts]. Monitors multicast timers which checks station entry age-outs and circuit group active circuits.
TCP Driver	Sends packet data over a Transmission Control Protocol (TCP) connection. Opens and closes connections, or drops packets when the queues are full. Remote Source-Route Bridging (RSRB), serial tunneling (STUN), X.25 switching, X.25 over TCP/IP (XOT), Data-link Switching (DLSW), translation, and all TCP connections that start or end at the router currently use TCP Driver.
TCP Timer	Handles retransmission of timeout packets.
Virtual exec	Handles virtual type terminal (vty) lines (for example, Telnet sessions on the router.)

High CPU utilization, by itself, does not indicate a problem with your device. As a rough guideline, only consistently high CPU utilization over an extended period of time indicates a problem. These commands do not identify a problem by themselves; rather, they help determine the cause of high CPU or memory utilization.

---

Related Information

• Troubleshooting High CPU Utilization
• ASR 1000 Series Router Memory Troubleshoot Guide
• Cisco Technical Support & Downloads

Revision History

Revision	Publish Date	Comments
3.0	15-Sep-2026	Updated spelling, grammar, inserted horizontal lines to separate sections for readability.
2.0	11-Dec-2023	Recertification
1.0	14-Dec-2001	Initial Release