我们有两个 Cisco SG500 52PP 型号分别通过光纤连接到我们的主 NOC 交换机。两台交换机几乎都采用标准配置，使用了 VLAN1，启用了 SNMP 以进行远程监控。这些交换机上连接的用户很少，交换机上没有负载。我们每隔几分钟就会观察到 CPU 峰值，它达到 100% 并且出现 ping 延迟变化。
sw-mkt-12-206#sho cpu utilization
CPU utilization service is on.
CPU utilization
---------------
five seconds: 100%; one minute: 100%; five minutes: 59%
一分钟后一切恢复正常。
以下是显示运行配置和相关输出...
sw-mkt-12-206#sh running-config
config-file-header
sw-mkt-12-206
v1.4.10.6 / R800_NIK_1_4_214_020
CLI v1.0
set system mode switch queues-mode 4
file SSD indicator encrypted
@
ssd-control-start
ssd config
ssd file passphrase control unrestricted
no ssd file integrity control
ssd-control-end cb0a3fdb1f3a1af4e4430033719968c0
!
cdp device-id format hostname
voice vlan oui-table add 0001e3 Siemens_AG_phone________
voice vlan oui-table add 00036b Cisco_phone_____________
voice vlan oui-table add 00096e Avaya___________________
voice vlan oui-table add 000fe2 H3C_Aolynk______________
voice vlan oui-table add 0060b9 Philips_and_NEC_AG_phone
voice vlan oui-table add 00d01e Pingtel_phone___________
voice vlan oui-table add 00e075 Polycom/Veritel_phone___
voice vlan oui-table add 00e0bb 3Com_phone______________
errdisable recovery interval 30
errdisable recovery cause loopback-detection
errdisable recovery cause dot1x-src-address
errdisable recovery cause acl-deny
errdisable recovery cause stp-bpdu-guard
errdisable recovery cause stp-loopback-guard
errdisable recovery cause udld
no boot host auto-config
no boot host auto-update
hostname sw-mkt-12-206
logging host 10.0.0.1
logging source-interface vlan 1
no passwords complexity enable
username XXXX password encrypted e006122cbXXXXXXXX23edffea1a861
ip ssh server
snmp-server server
snmp-server location "Marketing Switch 12.206 - Installed @ Feb 2017"
snmp-server contact "zzzz"
snmp-server community MYSNMP ro view Default
clock timezone " " +5
clock source sntp
clock source browser
sntp unicast client enable
sntp unicast client poll
sntp server 10.0.0.2 poll
sntp source-interface vlan 1
!
interface vlan 1
ip address 101.11.12.206 255.0.0.0
!
interface gigabitethernet1/1/23
description "AP - MKT2 HALL - .12.227"
!
interface gigabitethernet1/1/47
description "AP - MKT CORR .12.223"
!
interface gigabitethernet1/1/49
description ULINK_2_NOC
!
sw-mkt-12-206#sh spanning-tree
Spanning tree enabled mode RSTP
Default port cost method: long
Loopback guard: Disabled
Root ID Priority 1
Address c4:b9:cd:85:f5:80
Cost 20000
Port gi1/1/49
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Bridge ID Priority 61440
Address 00:8e:73:c0:93:a2
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Number of topology changes 392 last change occurred 38:25:04 ago
Times: hold 1, topology change 35, notification 2
hello 2, max age 20, forward delay 15
1-2 分钟后 ping 正常，CPU 恢复正常，并在重复几分钟后恢复正常。并且它在高峰时间或在没有用户在线的深夜不断发生。所以我猜一些进程开始了，它增加了 CPU，在它结束后，CPU 恢复正常。
我尝试将固件升级到最新版本，但无济于事。
关于如何跟踪它的任何建议？