Suddenly your router stops responding and forwarding traffic, you can telnet into it, response on the console is very slow. Few minutes later everything is back to normal and only "show process cpu history" shows that CPU was at 100% for some time, but what caused it remains a mystery. To catch a process(es) that might have contributed to the problem, add following command in global configuration mode:
process cpu threshold type process rising 70 interval 5 falling 30 interval 5
It will generate syslog message every time CPU usage exceeds 70% for 5 or more seconds and falls below 30%. For example:
May 10 23:50:23.146 EDT: %SYS-1-CPURISINGTHRESHOLD: Threshold: Process CPU Utilization(Total/Intr): 74%/26%, Top 3 processes(Pid/Util): 192/46%, 7/1%, 2/0%
Process id 192 contributed 46%. Let's see:
Router#sho proc cpu sor | i ^_192
192 904947881922327784 47 0.00% 0.18% 0.19% 0 IP Input
It was "IP Input" which is responsible for process-switching IP packets. Now we have something to work with and can start troubleshooting.