IT Management Solutions

4 Sep

SAM has had a default alert for high CPU load which will collect details from a server showing the top 10 processes by CPU utilisation. Therefore, when a high CPU load is detected by Orion an action within the alert will collect this information and then allow this to be displayed in the alert action output i.e. email.


Cisco IOS also has a command which allows the list of running processes on a Cisco IOS device to display what CPU utilisation is being consumed. This alert leverages this command to work in the same way as the SAM server high CPU load alert. The ability to capture information during the time the issue is being experienced can be invaluable for determining the cause and therefore the resolution, so hopefully, this alert will give you this insight.


The show processes cpu sorted’ command which is available in privileged mode shows the utilisation of the CPU by the system processes in the last 5 seconds, 1 minute and 5 minutes.


Switch# show processes cpu sorted

CPU utilization for five seconds: 5%/0%; one minute: 6%; five minutes: 5%

PID Runtime(ms) Invoked uSecs 5Sec 1Min 5Min TTY Process

1 4539 89782 50 0.00% 0.00% 0.00% 0 Chunk Manager

2 1042 1533829 0 0.00% 0.00% 0.00% 0 Load Meter

3 0 1 0 0.00% 0.00% 0.00% 0 DiagCard3/-1

4 14470573 1165502 12415 0.00% 0.13% 0.16% 0 Check heaps

5 7596 212393 35 0.00% 0.00% 0.00% 0 Pool Manager

6 0 2 0 0.00% 0.00% 0.00% 0 Timers

7 0 1 0 0.00% 0.00% 0.00% 0 Image Licensing

8 0 2 0 0.00% 0.00% 0.00% 0 License Client N

9 1442263 25601 56336 0.00% 0.08% 0.02% 0 Licensing Auto U

10 0 1 0 0.00% 0.00% 0.00% 0 Crash writer

11 979720 2315501 423 0.00% 0.00% 0.00% 0 ARP Input

12 0 1 0 0.00% 0.00% 0.00% 0 CEF MIB API

<output truncated>


*Source Cisco Troubleshooting High CPU Utilization KB


The alert action uses the NCM Execute script to connect and execute the command and will store the results in the Alert ‘Notes’ database field, which can be referenced in any further alert action via the following variable - ${N=Alerting;M=Notes}.



1: Not all Cisco devices support the ‘show processes cpu sorted’ command and some do not support the sorted parameter. Therefore, you may need to include further filters on the trigger section and/or within the NCM Execute script action remove the ‘sorted’ command parameter.


2: The alert contains the definition for inclusion, with the following rules included, which you may want to add to make work for you and your environment:


         Cisco IOS value is not empty

         Vendor = Cisco

         Node Status <> Down

         Critical CPU Threshold = True


The last one, I would like to highlight is an important improvement over the default High CPU alert within Orion, as this references the assigned critical threshold for each individual device and is not based on a singular value i.e. greater than 90%.


3: Adjust the Do Not Trigger condition to suit your needs. Currently, the 620 seconds ensures at least 2 polls are included in the analysis based on default polling frequencies.


Email Example




Training Courses for SolarWinds Customers

Prosperon Networks are the UK's leading authority on SolarWinds IT Management Solutions. We run training courses that suit a number of roles in your organisation, these courses cater for engineers, helpdesk operators and management personnel who all use monitoring platforms differently. The SolarWinds products retain their simplicity and ease of use, however product training in some form is recommended to get the most out of the tools we use every day.