How to find out why the processor is so busy?

Question

SSH

In the figure, the CPU load graph for 2960-10 from zabbix. Loading 55% is its stable state until you access the device via ssh. Then the download goes within 15%.
Immediately after connecting, you can see the following picture:
sh processes cpu sorted 5min
CPU utilization for five seconds: 10%/2%; one minute: 41% five minutes: 50%
But at the same time, there are no processes with a load greater than 2-3%.
After a couple of minutes, it already looks like this:
#sh processes cpu sorted 5min
CPU utilization for five seconds: 9%/1%; one minute: 10% five minutes: 29%

Answer 1

Put in cron:
top -n 1 >> log.txt
and look at the log.

Answer 2

in the course of picking...
whether it is possible to receive through snmp percent of loading of each process?
I get this line: .1.3.6.1.4.1.9.9.109.1.2.2.1.5, but there one of the values ​​\u200b\u200b= 3, the rest - 0.
Either this is not that, or rounding to integers.

Answer 3

What if you set up rsh access?
And on the server, make a script that collects data every n minutes with the command
rsh -l cisco_local_user 10.10.10.221 'show proc cpu sort | ex 0.00'