Percent network Utilization Graph of interface

[grmnrvs]

Hi

If the equipment allows to get the current total bandwidth, then it should be requested directly via the SNMP and the data item key must be used as a macro. Otherwise, you must create another calculated data element that takes into account the throughput of all ports.

Hi Kernbug

I was reading about Items in the Zabbix Documentation and i was could discover this, look at the attached pictures...

I need to change the 2512% to another value (in percent) like 25%, 2.5%, etc.

[grmnrvs]

Hi

If the equipment allows to get the current total bandwidth, then it should be requested directly via the SNMP and the data item key must be used as a macro. Otherwise, you must create another calculated data element that takes into account the throughput of all ports.

Another information Kernbug

In: Configuration > Host > Items > Create Item > Key (Select), i get this:

net.if.in[if,<mode>]	Incoming traffic statistics on network interface. Returns integer
net.if.list	Network interface list (includes interface type, status, IPv4 address, description). Returns text
net.if.out[if,<mode>]	Outgoing traffic statistics on network interface. Returns integer
net.if.total[if,<mode>]	Sum of incoming and outgoing traffic statistics on network interface. Returns integer

I don't know whats means <mode>

Sorry for the inconvenience...

[Linwood]

The net.if.total (etc) is about the zabbix agent, and not SNMP. The agent is only available on systems like unix, windows, etc. That's fine if that's what you are interested in, but most discussion of network bandwidth graphs related to devices like routers, switches, etc., that generally will not be able to use the Zabbix agent, and instead use an SNMP agent. There you are limited to what that device allows you to query from via SNMP, and defined in its MIBs form the manufacturer.

To get a total in SNMP add the value from input and output if you have it, either in the trigger for giving an error, or in a calculated item.

I think two things are being confused in these last few entries. One is the AVAILABLE bandwidth. That is often not visible in SNMP (or the agent), and if visible may be wrong. When visible it is in ifSpeed and/or ifHighSpeed (not sure I spelled that last right), but that itself might not show actual bandwidth but physical media bandwidth. In some Cisco's (for example) you can use the CLI command for BANDWIDTH to set actual bandwidth, but if memory serves can only set a symmetric value; if you had asymmetric bandwidth (say 100mbs down and 20 up) I do not think it will let you specify it. For others, you would need to determine the actual underlying media's expected throughput and code that in the rules (and again, as a macro makes it more easily changeable).

Bear in mind a network device usually does not actually KNOW the bandwidth of the underlying connection, especially WANs delivered over ethernet.

The other is the bandwidth used. The device will know that, mostly (there are some, mostly older cases over serial links, where compression impacts the values). That's available from the in and out octets. If you need to combine it, add.

BUT... combining input and output bandwidth is arguably incorrect. A circuit will rarely saturate in both directions at once, so identifying problems on a circuit by looking at the sum of activity in and out will fail to detect cases where (say) input saturates but output is low. If you want useful statistics (useful as in noticing either short or long term excessive consumption) you need to treat them separately.

[grmnrvs]

The net.if.total (etc) is about the zabbix agent, and not SNMP. The agent is only available on systems like unix, windows, etc. That's fine if that's what you are interested in, but most discussion of network bandwidth graphs related to devices like routers, switches, etc., that generally will not be able to use the Zabbix agent, and instead use an SNMP agent. There you are limited to what that device allows you to query from via SNMP, and defined in its MIBs form the manufacturer.

If I know, net.if.total is only for agent Zabbix. What I need is for Zabbix to monitor 2 kinds of network devices using SNMP. 5 or 6 Cisco 3560 switches and a 47 HPE 3600 switches.

To get a total in SNMP add the value from input and output if you have it, either in the trigger for giving an error, or in a calculated item.

Ok, can you tell me how to add the input and output value in the trigger and in the calculated element?
If I make a query using "snmpwalk" in the results I get a lot of information but nowhere do I see that it says "total bandwidth of input and output", I think I must do this through a macro, right?

I think two things are being confused in these last few entries. One is the AVAILABLE bandwidth. That is often not visible in SNMP (or the agent), and if visible may be wrong. When visible it is in ifSpeed and/or ifHighSpeed (not sure I spelled that last right), but that itself might not show actual bandwidth but physical media bandwidth. In some Cisco's (for example) you can use the CLI command for BANDWIDTH to set actual bandwidth, but if memory serves can only set a symmetric value; if you had asymmetric bandwidth (say 100mbs down and 20 up) I do not think it will let you specify it. For others, you would need to determine the actual underlying media's expected throughput and code that in the rules (and again, as a macro makes it more easily changeable).

Bear in mind a network device usually does not actually KNOW the bandwidth of the underlying connection, especially WANs delivered over ethernet.

The other is the bandwidth used. The device will know that, mostly (there are some, mostly older cases over serial links, where compression impacts the values). That's available from the in and out octets. If you need to combine it, add.

BUT... combining input and output bandwidth is arguably incorrect. A circuit will rarely saturate in both directions at once, so identifying problems on a circuit by looking at the sum of activity in and out will fail to detect cases where (say) input saturates but output is low. If you want useful statistics (useful as in noticing either short or long term excessive consumption) you need to treat them separately.

Ok I understand, what we need is to know if zabbix can show us information about the bandwidth used.

The links are dedicated of 12 Mbps, on this link at both ends there will be 2 HPE 3600 devices for example and we want to know the bandwidth used of those 12 Mbps assigned to the dedicated link.

I know how to get the incoming bandwidth used from a port with this macro:

100 * last (net.if.in [ifHCInOctets.10121]) / 1073741824

NOTE: 1 gigabytes = 1073741824 bytes
10121 corresponds to the ethernet port 21.

But I do not know how to perform the same macro to know the percentage of incoming bandwidth more outgoing from the same port 21, and this I would like to know but with a macro that includes the incoming and outgoing traffic of all ports for example port 21, 22, 23, 24, and 25. What would be the total bandwidth in those five ports?

I have seen that there is a plugin called "Weathermap" that shows something similar to what I need. Do you know this?

[Linwood]

I don't have time right now to write the code, but hopefully can get you started.

My suggestion is to create two items, one for input bandwidth used, one for output bandwidth used. These are regular snmp queries like against ifOutOctets and ifOutOctects (these are probably inside a Low Level Discovery prototype).

Then create a calculated item which adds them together. This is a separate item, that references the two values.

Then create a trigger that checks the value of the calculated item against the limit you want. That limit could come from yet another item using ifSpeed (if you have a Cisco and code bandwidth), or it could be a value you put in a Macro and then manually set. The problem with a macro is that those are host specific not interface specific, so if there are more interfaces than just one on a device I do not see how you get the interface specific value.

You also continue to use the net function in your example, you are even calling it a macro. That may be a language issue, or is a fundamental misunderstanding. Your example refers to an SNMP Agent function and I can't see how you are going to get it to work with the Zabbix Agent. I think you are confusing SNMP Agent and Zabbix agent (they are quite different and different syntax). You are also confusing macros with expressions; not really very similar.

As to adding together the in/out bandwidth across ports you cannot do that in a template (at least not usefully), you should add a calculated item to the host itself, and literally add them all together one by one in an expression. It's hard coded and and not elegant. And if it is between two different devices I do not see how you can do it at all in native zabbix, I would consider using an external check and querying the values you want, and just return the answer directly from your script.

[grmnrvs]

I don't have time right now to write the code, but hopefully can get you started.

This would be very useful!!!

My suggestion is to create two items, one for input bandwidth used, one for output bandwidth used. These are regular snmp queries like against ifOutOctets and ifOutOctects (these are probably inside a Low Level Discovery prototype).

Then create a calculated item which adds them together. This is a separate item, that references the two values.

Then create a trigger that checks the value of the calculated item against the limit you want. That limit could come from yet another item using ifSpeed (if you have a Cisco and code bandwidth), or it could be a value you put in a Macro and then manually set. The problem with a macro is that those are host specific not interface specific, so if there are more interfaces than just one on a device I do not see how you get the interface specific value.

You also continue to use the net function in your example, you are even calling it a macro. That may be a language issue, or is a fundamental misunderstanding. Your example refers to an SNMP Agent function and I can't see how you are going to get it to work with the Zabbix Agent. I think you are confusing SNMP Agent and Zabbix agent (they are quite different and different syntax). You are also confusing macros with expressions; not really very similar.

As to adding together the in/out bandwidth across ports you cannot do that in a template (at least not usefully), you should add a calculated item to the host itself, and literally add them all together one by one in an expression. It's hard coded and and not elegant. And if it is between two different devices I do not see how you can do it at all in native zabbix, I would consider using an external check and querying the values you want, and just return the answer directly from your script.

Ok i take your suggestion but i think that this feature is very useful in a monitoring environment like Zabbix. I see whats results i get and i tell you.

A hug!!!

[lpossamai]

I've got a Cisco ASA and am monitoring the network interfaces as well as the VPN traffic with Zabbix 3.4.
You can check more info here: https://www.zabbix.com/forum/zabbix-...-traffic-state

[grmnrvs]

I've got a Cisco ASA and am monitoring the network interfaces as well as the VPN traffic with Zabbix 3.4.
You can check more info here: https://www.zabbix.com/forum/zabbix-...-traffic-state

Thank you very much for the information lpossamai

A hug!!!

[grmnrvs]

Linwood
I did what you recommended me. Look.

These are the results of both queries in SNMPWALK


Then, in Template Module Interfaces SNMPv2 > Discovery Rules > Item Prototypes I made these two ítems


An image of each one


Then i made the Calculated Item



...and finally this is the result but with error



The red letters say
Cannot evaluate function "last()": item "SW_SALA-CEO:net.if.in[ifInOctets.{#SNMPINDEX}]" does not exist.



Did I do something wrong? I would like to correct it before continuing to the trigger configuration...

A hug and thank you so much!!!

[kernbug]

Linwood

Cannot evaluate function "last()": item "SW_SALA-CEO:net.if.in[ifInOctets.{#SNMPINDEX}]" does not exist.

Hi,

You need to specify exact item key, not ....{#SNMPINDEX}]" in the calculated items. Please, see more examples: https://www.zabbix.com/documentation...pes/calculated

[grmnrvs]

Hi,

You need to specify exact item key, not ....{#SNMPINDEX}]" in the calculated items. Please, see more examples: https://www.zabbix.com/documentation...pes/calculated

Ok Kernbug

But remember that I created a calculated item to add the two SNMPv2 agent item totals, as I suggested that Linwood


I have read that documentation but it is not very clear to me how to create a calculated item to add the result of both items of agent snmp.


Can you tell me if the snmp items are ok?

[kernbug]

I have read that documentation but it is not very clear to me how to create a calculated item to add the result of both items of agent snmp.

The macro is used to generate the final values of the data items - keys, names, etc. To create the calculated data item, you must use the final keys obtained after the creation of the data elements by discovery rules on a specific host. A matched action can only be performed on existing data items.

You have already done this before:

Thanks again kernbug and its works!!! This is the correct key value:

• 100*last(net.if.in[ifHCInOctets.10121])/1073741824

NOTE: Where 1 gigabytes = 1073741824 bytes (I use this Bit Calculator)

Highlighted in red, not {$MACRO} but specific interface item key.

[grmnrvs]

The macro is used to generate the final values of the data items - keys, names, etc. To create the calculated data item, you must use the final keys obtained after the creation of the data elements by discovery rules on a specific host. A matched action can only be performed on existing data items.

You have already done this before:

Highlighted in red, not {$MACRO} but specific interface item key.

Ok. I wrote the formula of the calculated item as follows

100*last(net.if.in[ifHCInOctets.10101])+last(net.if.out[ifHCOutOctets.10101])+last(net.if.in[ifHCInOctets.10102])+last(net.if.out[ifHCOutOctets.10102])+last(net.if.in[ifHCInOctets.10103])+last(net.if.out[ifHCOutOctets.10103])/1073741824


Remember that the switch has 24 ports, should I continue to write each item or port as I showed above or is there any abbreviated way?

This shows the graph with the sum totals of interfaces 21, 22 and 23.




I do not like that you show 1816528%, how can I correct that?


Thank you Kernbug

[kernbug]

Remember that the switch has 24 ports, should I continue to write each item or port as I showed above or is there any abbreviated way?

I do not like that you show 1816528%, how can I correct that?

The total bandwidth betwen Host A and Host B is of 12M

• The total Incoming used is: X%
• The total Outbound used is: X%

Where X is the sum of the all interfaces both for the incoming traffic and the outgoing traffic.

Please, adapt math according to your task.

[grmnrvs]

Please, adapt math according to your task.

I did it but it still does not work

This is my Calculated Item Formula

100*last(net.if.in[ifHCInOctets.10101])+last(net.if.out[ifHCOutOctets.10101])+last(net.if.in[ifHCInOctets.10102])+last(net.if.out[ifHCOutOctets.10102])+last(net.if.in[ifHCInOctets.10103])+last(net.if.out[ifHCOutOctets.10103])+last(net.if.in[ifHCInOctets.10104])+last(net.if.out[ifHCOutOctets.10104])+last(net.if.in[ifHCInOctets.10105])+last(net.if.out[ifHCOutOctets.10105])+last(net.if.in[ifHCInOctets.10106])+last(net.if.out[ifHCOutOctets.10106])+last(net.if.in[ifHCInOctets.10107])+last(net.if.out[ifHCOutOctets.10107])+last(net.if.in[ifHCInOctets.10108])+last(net.if.out[ifHCOutOctets.10108])+last(net.if.in[ifHCInOctets.10109])+last(net.if.out[ifHCOutOctets.10109])+last(net.if.in[ifHCInOctets.10110])+last(net.if.out[ifHCOutOctets.10110])+last(net.if.in[ifHCInOctets.10111])+last(net.if.out[ifHCOutOctets.10111])+last(net.if.in[ifHCInOctets.10112])+last(net.if.out[ifHCOutOctets.10112])+last(net.if.in[ifHCInOctets.10113])+last(net.if.out[ifHCOutOctets.10113])+last(net.if.in[ifHCInOctets.10114])+last(net.if.out[ifHCOutOctets.10114])+last(net.if.in[ifHCInOctets.10115])+last(net.if.out[ifHCOutOctets.10115])+last(net.if.in[ifHCInOctets.10116])+last(net.if.out[ifHCOutOctets.10116])+last(net.if.in[ifHCInOctets.10117])+last(net.if.out[ifHCOutOctets.10117])+last(net.if.in[ifHCInOctets.10118])+last(net.if.out[ifHCOutOctets.10118])+last(net.if.in[ifHCInOctets.10119])+last(net.if.out[ifHCOutOctets.10119])+last(net.if.in[ifHCInOctets.10120])+last(net.if.out[ifHCOutOctets.10120])+last(net.if.in[ifHCInOctets.10121])+last(net.if.out[ifHCOutOctets.10121])+last(net.if.in[ifHCInOctets.10122])+last(net.if.out[ifHCOutOctets.10122])+last(net.if.in[ifHCInOctets.10123])+last(net.if.out[ifHCOutOctets.10123])+last(net.if.in[ifHCInOctets.10124])+last(net.if.out[ifHCOutOctets.10124])+last(net.if.in[ifHCInOctets.3])+last(net.if.out[ifHCOutOctets.3])/1073741824




What you see is 100 * the sum of all the ports (in/out) divided by 1 Gbps (in bytes)

NOTE: 1 Gigabytes = 1073741824 Bytes





I begin to feel sad for not being able to solve it and bother you so much...

Look the scale!!! Omg....