Description

In some situations, CPU utilization on EX Series switches may be high due to underlying high SFID process utilization. This article provides suggestions on what must be done if you encounter such a problem.

Symptoms

One of the reasons for high CPU utilization is the SFID thread consuming more than usual CPU cycles. This can be confirmed by checking process level utilization by using the following command: 

root@EXr001> show system processes extensive no-forwarding

last pid:  5134;  load averages:  1.44,  1.39,  1.33  up 1639+07:58:15    12:23:24
121 processes: 4 running, 96 sleeping, 21 waiting

Mem: 371M Active, 61M Inact, 101M Wired, 150M Cache, 112M Buf, 1302M Free
Swap:

  PID USERNAME         THR  PRI  NICE    SIZE    RES   STATE    TIME   WCPU COMMAND
 1268 root                         2   44   -52      71692K   18524K select    ???         33.01%        sfid
   11 root                            1  171    52     0K            16K RUN         ???       23.54%       idle

In the above excerpt, SFID is using 33.01% of CPU, which is very high.

Solution

The Ethernet logs show that the same MAC addresses are being learned frequently on different interfaces within a split second of time. 

root@EXr001> show ethernet-switching mac-learning-log

Thu Jan 21 12:18:32 2021  vlan_name admin_management mac 00:a0:98:d0:45:dc was learned on ge-1/0/33.0
Thu Jan 21 12:18:32 2021  vlan_name vmnas113 mac 00:a0:98:d0:45:de was learned on xe-0/0/16.0
Thu Jan 21 12:18:41 2021  vlan_name vmnas112 mac 00:a0:98:a1:d9:53 was learned on ae0.0
Thu Jan 21 12:18:42 2021  vlan_name vmnas113 mac 00:a0:98:a1:d9:53 was learned on ae0.0
Thu Jan 21 12:18:42 2021  vlan_name nas114 mac 00:a0:98:a1:d9:53 was learned on ae0.0
Thu Jan 21 12:18:43 2021  vlan_name nas115_private mac 00:a0:98:a1:d9:53 was learned on ae0.0
Thu Jan 21 12:18:43 2021  vlan_name nas115_private mac 00:a0:98:a1:d9:51 was learned on xe-0/0/18.0

These MAC update packets are punted to the CPU, honored, and not dropped. In such situations, high SFID is expected. 

Some of the other reasons that cause high SFID utilization are:

  • High VSTP connections resulting in a high number of VSTP BPDUs, which are punted to the CPU

  • IGMP snooping enabled on a box with a high ARP rate (500 pps)

Frequent learning of the same MAC addresses may be indicative of a loop in the network. Check if frequent learning of the same MAC addresses is expected. Constant learning of the same MAC addresses on different interfaces is not uncommon in Data Center environments. However, in other environments, this is not expected.

If SFID is high and frequent MAC moves are not seen, then contact Support to help find the root cause for the issue.