Monitoring Cisco SWITCH

[jansonz]

Hello,

I'm using Zabbix to monitor my Cisco switches. Everything seemed to be Ok, but know, when I needed to get port traffic for a client I noticed a strange thing. Zabbix shows traffic less, than it really is. For example Cisco shows that it has 24 Mbit/s traffic, but Zabbix shows only 417.72 Kbits/s. Where could be the problem? The item is configured like this:
Type: SNMPv1 agent,
SNMP OID for example ifOutOctets.40,
SNMP port: 161,
Type of information: Numeric (float),
Units: bits/s,
Use multiplier: Custom multiplier,
Custom multiplier: 8,
Store value: Delta.

My Zabbix version: ZABBIX 1.4.5

[8mad]

hello,
your parameter are correct, I suggest to verify the port number. Classic error is the number port is...26, but on the OID is....x exemple Key=ifOutOctets27.
Moreover use SNMP OID as.... ... 1.3.6.1.2.1.2.2.1.16.26

We are monitoring CISCO Catalyst and 3COM switch correctly.

bye
Silvio

My Zab is 1.4.5 and 1.6.1 in test

[jansonz]

omg, yes, you right. The first interface is VLAN1 for default. How silly mistake... Thanks for Help

[dantheman]

What really through me off, some of our Cisco Switches have the VLANs listed before the switch ports...and others have them listed after the switch ports.... so just keep that in mind as you monitor more switches.

[bee]

ifInHCOctet NOT ifInOctet (RFC 2233) - CMIIW

Hi, There something bother me about accuracy of switch port monitoring. I'm quoting some statement from RFC 2233 below:

For interfaces that operate at 20,000,000 (20 million) bits per
second or less, 32-bit byte and packet counters MUST be used. For interfaces that operate faster than 20,000,000 bits/second, and slower than 650,000,000 bits/second, 32-bit packet counters MUST be used and 64-bit octet counters MUST be used. For interfaces that operate at 650,000,000 bits/second or faster, 64-bit packet counters AND 64-bit octet counters MUST be used.

In my understanding, for switch port which have 100Mbps speed (equal to 104.857.600bps) it match with statement

For interfaces that operate faster than 20,000,000 bits/second, and slower than 650,000,000 bits/second, 32-bit packet counters MUST be used and 64-bit octet counters MUST be used.

So, for 100Mbps switch port, *in my opinion base on RFC 2233*, to capture the octet, We SHOULD use ifInHCOctet/ifOutHCOctet NOT ifInOctet/ifOutOctet.

No only Cisco switch, DELL switch also capture octet using ifInOctet instead of ifInHCOctet..

I'm open for discussion. And i'll be glad if there's someone have better explanation about this and give the correction to me.

Further detail on RFC2233, please refer to:

http://tools.ietf.org/html/rfc2233#section-3.1.6

[MrKen]

For me, I just snmpwalk ifIn/OutOctets, then snmpwalk ifHCIn/OutOctets. If there are values for ifHC, then I use those values rather than the 32 bit.
Seems to work fine.

MrKen

[bee]

Hi MrKen,
However, it will lead to hesitation especially when you capture switch port using ifHCin/out octet and then your manager refer to switch's vendor value. I believe, most of switch vendor today, capture the port utilization by using ifIn/OutOctet NOT ifHCin/OutOctet.

When the accuracy is important, which CORRECT value must be used? Ifin/outOctet or IfHCin/outOctet? If the correct value is ifHCin/OutOctet, than we must tell vendor to change their way on capturing port utilization to avoid this mislead of information.

Thanks,
BEE

[RohrbaGe]

Cisco templates

Hi,

can someone help me with templates for Cisco 3508,3524 and 3548?
I have tried to setup the interface monitoring , but was not successfull.

Also I would like to monitor the fan status, does someone know if that is possible
on those switches?

Regards
Gerald

[troffasky]

Also I would like to monitor the fan status, does someone know if that is possible on those switches?

Install the relevant MIBs and then snmpwalk the switch. Grep the output for 'fan'. If you see a value, then you can monitor it. If you've got any further questions about this, you might like to start a new thread.

[troffasky]

So, for 100Mbps switch port, *in my opinion base on RFC 2233*, to capture the octet, We SHOULD use ifInHCOctet/ifOutHCOctet NOT ifInOctet/ifOutOctet.

Problem is, what if you create a template for an access switch where there is a mixture of Ethernet, Fast Ethernet and Gigabit Ethernet? There's no way in Zabbix to automatically select ifInOctets.n or ifHCInOctets.n based on the value of IF-MIB::ifHighSpeed.n. Personally I can't see what the problem would be with using 64-bit counters on a 10M interface [other than wasting space in the DB], but there has to be a reason why the RFC authors have said 'MUST'. Perhaps somebody can explain?

[odium4u]

See this handy little script.

http://www.zabbix.com/forum/showpost.php?p=38825&postcount=3

It will take all that work away.

[Slowride]

See this handy little script.

http://www.zabbix.com/forum/showpost.php?p=38825&postcount=3

It will take all that work away.

can you explain were in the script is the logic to decide between v1 IfinOctets and v2 IfHCInOctets?

ifHCInOctets
.1.3.6.1.2.1.31.1.1.1.6.<port>

ifHCOutOctets
.1.3.6.1.2.1.31.1.1.1.10.<port>