In zabbix 2.4.6rc1 I am polling cisco switches with LLD discovered items among which are:
RFC1213-MIB::ifInUnknownProtos
The item is set up as a "simple delta".
When I do an SNMPWALK, these values look reasonable (either slight increases or no change). But for some switches (not all), for some interfaces (not all), I get the value 15.
Always 15 when it's wrong. The 15 (almost) never changes, even if doing an SNMP walk I can see it change. The item is polling (the last update date changes). I increased debug to 4 and see it come up in the output but not show errors (I do not know whether it is supposed to show values in the log, I did not see any). I found exactly one case where I see the 15 change to 17, then goes back to 15. All others (that appear wrong) seem to always be 15.
I queried history_uint and also see 15 there with various clock values. I see numbers of "ns" but do not know what that field means.
I've compared to other values (like regular discards) and the setup of the item looks identical, and they seem to work, only this one fails in this way.
I've rebooted and restarted zabbix and no change. Still 15 on the same items.
And again, snmpwalk looks right, e.g.
snmpwalk -v2c -c stuff 10.100.1.1 RFC1213-MIB::ifInUnknownProtos
IF-MIB::ifInUnknownProtos.1 = Counter32: 0
IF-MIB::ifInUnknownProtos.2 = Counter32: 0
...
IF-MIB::ifInUnknownProtos.10019 = Counter32: 140365
IF-MIB::ifInUnknownProtos.10020 = Counter32: 139955
IF-MIB::ifInUnknownProtos.10021 = Counter32: 140366
IF-MIB::ifInUnknownProtos.10022 = Counter32: 140352
IF-MIB::ifInUnknownProtos.10023 = Counter32: 28850
IF-MIB::ifInUnknownProtos.10024 = Counter32: 0
...
IF-MIB::ifInUnknownProtos.10501 = Counter32: 0
I omitted a bunch of them, but the one at index 10021 (happens to be Fastethernet 0/21) is one that is wrong -- the others around it look right (show a steady zero as these are not recent -- interface 21 is creeping up occasionally.
Caveat: I have not been able to easily verify that ALL the ones showing zero are right -- only a few I've checked and watched manually for a while. It could be that they are all wrong, and some showing zero that just happen to be correct. I don't have a good way, until I find an interface showing zero that is changing in snmpwalk, to know if the zero's are right.
Here's a copy/paste of the item definition key:
snmp.agent[RFC1213-MIB::ifInUnknownProtos.10021]
I feel like I'm missing something obvious, but I do not know what else to check.
Is there some way, short of digging into the source and instrumenting it somewhere) to see more fully what it is polling and how it is doing the "simple delta"?
Oh... the polling interval is 900, which is 15 minutes of course. That's the only connection I can find.
Any ideas what to check?
PS. The above example is from a 356048PS Cisco running ios 12.2(53)SE and yes I know that's really old but don't have any input into their update cycle. The device in port 21 is a phone, I think with a PC cascaded off it. No other unusual values show on that port.
RFC1213-MIB::ifInUnknownProtos
The item is set up as a "simple delta".
When I do an SNMPWALK, these values look reasonable (either slight increases or no change). But for some switches (not all), for some interfaces (not all), I get the value 15.
Always 15 when it's wrong. The 15 (almost) never changes, even if doing an SNMP walk I can see it change. The item is polling (the last update date changes). I increased debug to 4 and see it come up in the output but not show errors (I do not know whether it is supposed to show values in the log, I did not see any). I found exactly one case where I see the 15 change to 17, then goes back to 15. All others (that appear wrong) seem to always be 15.
I queried history_uint and also see 15 there with various clock values. I see numbers of "ns" but do not know what that field means.
I've compared to other values (like regular discards) and the setup of the item looks identical, and they seem to work, only this one fails in this way.
I've rebooted and restarted zabbix and no change. Still 15 on the same items.
And again, snmpwalk looks right, e.g.
snmpwalk -v2c -c stuff 10.100.1.1 RFC1213-MIB::ifInUnknownProtos
IF-MIB::ifInUnknownProtos.1 = Counter32: 0
IF-MIB::ifInUnknownProtos.2 = Counter32: 0
...
IF-MIB::ifInUnknownProtos.10019 = Counter32: 140365
IF-MIB::ifInUnknownProtos.10020 = Counter32: 139955
IF-MIB::ifInUnknownProtos.10021 = Counter32: 140366
IF-MIB::ifInUnknownProtos.10022 = Counter32: 140352
IF-MIB::ifInUnknownProtos.10023 = Counter32: 28850
IF-MIB::ifInUnknownProtos.10024 = Counter32: 0
...
IF-MIB::ifInUnknownProtos.10501 = Counter32: 0
I omitted a bunch of them, but the one at index 10021 (happens to be Fastethernet 0/21) is one that is wrong -- the others around it look right (show a steady zero as these are not recent -- interface 21 is creeping up occasionally.
Caveat: I have not been able to easily verify that ALL the ones showing zero are right -- only a few I've checked and watched manually for a while. It could be that they are all wrong, and some showing zero that just happen to be correct. I don't have a good way, until I find an interface showing zero that is changing in snmpwalk, to know if the zero's are right.
Here's a copy/paste of the item definition key:
snmp.agent[RFC1213-MIB::ifInUnknownProtos.10021]
I feel like I'm missing something obvious, but I do not know what else to check.
Is there some way, short of digging into the source and instrumenting it somewhere) to see more fully what it is polling and how it is doing the "simple delta"?
Oh... the polling interval is 900, which is 15 minutes of course. That's the only connection I can find.
Any ideas what to check?
PS. The above example is from a 356048PS Cisco running ios 12.2(53)SE and yes I know that's really old but don't have any input into their update cycle. The device in port 21 is a phone, I think with a PC cascaded off it. No other unusual values show on that port.