The Routing Engine (RE) runs multiple processes in a protected memory environment (such as rpd, flowd, snmpd, etc.). Each process consumes CPU cycles based on its current state. Any unusual activity in these processes or their environment can cause the RE CPU utilization to become high.

High RE CPU generally does not impact traffic forwarding unless routing protocols are affected due to consistently high CPU usage.

• Slow or no CLI response
• Device becomes inaccessible
• Routing protocols drop due to sustained high CPU
• Possible device reboot in extreme cases
• Inconsistent or unexpected behavior

Possible Causes

• Attacks: DoS, DDoS, or similar
• Excessive routing updates caused by network issues
• Large trace configurations or flag all enabled for high-activity processes
• Packet capture running for prolonged time without proper filters.
• A process stuck and consuming excessive CPU cycles
• Large configuration commits (e.g., 1000 IPSec tunnels at once)

Solution / Troubleshooting Steps

• Check RE CPU Usage
  • show chassis routing-engine
  • show system processes extensive

• Interpretation:
  • User/Kernel: Likely caused by a process
  • Interrupt: Indicates heavy traffic received on RE (verify with show system statistics)

• If SNMP Health Monitor is Configured
  • show snmp health-monitor routing-engine history cpu extensive
  • show log messages | match snmpd_health_mon_thresh_cross

• Mitigation
  • Delete unnecessary trace options / packet capture.
  • Investigate and resolve stuck processes
  • Review recent configuration changes and optimize large commits
  • Check for network anomalies causing excessive routing updates
  • Implement security measures against DoS/DDoS attacks

• Escalation
  • If the issue persists or impacts routing protocols, contact JTAC for further assistance.