Show Active Cisco IOS Processes

The show process cpu sorted EXEC command which is issued with the combinations of output filters can be used to display only those active IOS processes that consumed noticeable amount of CPU time and resource over the last 5 seconds, 1 minute, and 5 minutes.

The following patterns are used to construct the regular expressions for the mentioned purpose:
i) The [0-9.]+% pattern will match any non-zero percentage value;
ii) The 0.00% pattern will match the zero percentage value;
iii) As the percentage values are separated by various amounts of space characters, the + pattern is used to match those.

The output filters should exclude the processes that have the zero percentage in the desired column and any percentage value in the other 2 columns.

Below shows the exact show commands used to display the active processes in the last 5 minutes, 1 minute, and 5 seconds.

5 secs	show process cpu sorted 5sec | exclude 0.00% +[0-9.]+% +[0-9.]+%
1 min	show process cpu sorted 1min | exclude [0-9.]+% +0.00% +[0-9.]+%
5 mins	show process cpu sorted 5min | exclude [0-9.]+% +[0-9.]+% +0.00%

Below shows a sample output from a router:

Router>show process cpu sorted 5sec | exclude 0.00% +[0-9.]+% +[0-9.]+%
CPU utilization for five seconds: 18%/3%; one minute: 22%; five minutes: 21%
 PID Runtime(ms)   Invoked      uSecs   5Sec   1Min   5Min TTY Process
 141   262418490  83111379       3157 11.70% 13.51% 13.41%   0 encrypt proc
   5     7832705    443427      17664  2.21%  0.46%  0.37%   0 Check heaps
  56    19292254  16716172       1154  0.16%  0.80%  0.89%   0 IP Input
 100     1172442   4098350        286  0.16%  0.07%  0.06%   0 DHCPD Receive
 211     1093462  63950042         17  0.16%  0.07%  0.06%   0 PPP Events
   2     1947017    411375       4732  0.08%  0.09%  0.08%   0 Load Meter
 210     1411416  63950011         22  0.08%  0.07%  0.07%   0 PPP manager
 116      370688   3280908        112  0.08%  0.03%  0.00%   0 CEF process
 114      308130   8423193         36  0.08%  0.02%  0.00%   0 Inspect Timer
Router>
Router>show process cpu sorted 1min | exclude [0-9.]+% +0.00% +[0-9.]+%
CPU utilization for five seconds: 18%/3%; one minute: 22%; five minutes: 21%
 PID Runtime(ms)   Invoked      uSecs   5Sec   1Min   5Min TTY Process
 141   262418586  83111423       3157 11.70% 13.51% 13.41%   0 encrypt proc
 144       11148     85202        130  0.00%  3.01%  2.11%  66 Virtual Exec
  56    19292270  16716188       1154  0.16%  0.80%  0.89%   0 IP Input
   5     7832705    443427      17664  2.21%  0.46%  0.37%   0 Check heaps
   2     1947017    411375       4732  0.08%  0.09%  0.08%   0 Load Meter
 210     1411416  63950063         22  0.08%  0.07%  0.07%   0 PPP manager
 211     1093462  63950094         17  0.16%  0.07%  0.06%   0 PPP Events
 100     1172446   4098354        286  0.16%  0.07%  0.06%   0 DHCPD Receive
 116      370692   3280911        112  0.08%  0.03%  0.00%   0 CEF process
 114      308130   8423203         36  0.08%  0.02%  0.00%   0 Inspect Timer
   8      364776    480408        759  0.00%  0.01%  0.00%   0 ARP Input
 217      960116    154212       6225  0.00%  0.01%  0.01%   0 SNMP ENGINE
Router>