Host snmp availabilty is wrong

[BobMart]

Hello,

I have a Zabbix server v6.0 installed on Ubuntu 22.04 and hosts on SNMP v2. I have troubles with some SNMP hosts that zabbix returns available but are not. Even if I checked manually the value, zabbix always returns (1 - available). These hosts are not available as the link between zabbix and them is down and ping is down too.
I have others hosts that works fine (SNMP changed to unavailable when the link is down). Seems that all hosts for the same brand/model are affected.
I checked zabbix documentation but don't really understand how the value for snmp availability for the key zabbix[host, snmp, available] is calculated.

[cyber]

https://www.zabbix.com/documentation...host.available

• The item value is calculated according to the configuration parameters regarding host unreachability/unavailability.

If your host is really unreachable, you should find something like "temporarily disabling SNMP checks on host "<your host>": interface unavailable" in server/proxy logs.

[onyx]

hello cyber, my zabbix going wrong, the host really unreachable because it show "temporary disabling SNMP" for all host, What should I do now? Can you help?
Thankyou

[BobMart]

Thanks cyber.
I already checked your link before I openned this post, but cannot find the information I need. My SNMP timeout is 15min, and I checked availability every 5min.

If your host is really unreachable, you should find something like "temporarily disabling SNMP checks on host "<your host>": interface unavailable" in server/proxy logs.

How can I access log ? I searched for in the interface of zabbix server but didn't find anything.

[postowy-zabbix]

Thanks cyber.
I already checked your link before I openned this post, but cannot find the information I need. My SNMP timeout is 15min, and I checked availability every 5min.


How can I access log ? I searched for in the interface of zabbix server but didn't find anything.

Zabbix server log on OS:

[root@zbx7 ~]# grep -i "interface unavailable" /var/log/zabbix/zabbix_server.log
1268299:20231203:192325.246 temporarily disabling SNMP agent checks on host "RTR-xxx": interface unavailable
1268299:20231203:192741.245 temporarily disabling SNMP agent checks on host "RTR-xxx": interface unavailable

[BobMart]

Zabbix server log on OS:

[root@zbx7 ~]# grep -i "interface unavailable" /var/log/zabbix/zabbix_server.log

I tried and seems thats log are only available for 1 day, as I have only 1 line returned and the datetime is today. Is it normal ? Anyway, as my hosts are all available, I cannot test right now. But I still don't undestand why I had this problem and how the value is calculated. The link upper just explain " temporarily disabling SNMP agent checks on host "RTR-xxx": interface unavailable" will be returned if the SNMP host is unavailable but don't explain how the key zabbix[host, snmp, available] is calculated, or I don't understand

[cyber]

• The item value is calculated according to the configuration parameters regarding host unreachability/unavailability.

You should understand, what is unreachability and what is unavailability in Zabbix terms... Like, if first try fails, then how many times and with what kind of interval it is checked until it is defined as unreachable and what happens next...

I can understand your frustration, but there is just too little information for us to even think, what could be wrong, that's why reading logs is suggested.. And also explanation, when something is written there ..
Maybe something pops up from there, that is related to your snmp hosts..

[BobMart]

What other informations do you need ?

Here is what I understand from your link:

• if interface is unreached, it will try 15s later until 'UnreachablePeriod' is reached
• then, when unavailable, it will checked each 60s and write "interface unavailable" in the log

How does that help me in my problem ? I only know when log will be written, not how the key zabbix[host, snmp, available] is calculated.

[cyber]

What other informations do you need ?

Here is what I understand from your link:

• if interface is unreached, it will try 15s later until 'UnreachablePeriod' is reached
• then, when unavailable, it will checked each 60s and write "interface unavailable" in the log

How does that help me in my problem ? I only know when log will be written, not how the key zabbix[host, snmp, available] is calculated.

Hold your horses.. you just described how that key is calculated.. Result is written to DB, to interface table...

Availability of host interface.

Possible values:
0 - (default) unknown;
1 - available;
2 - unavailable.

https://www.zabbix.com/documentation/current/en/manual/api/reference/hostinterface/object

What does this "SNMP hosts that zabbix returns available but are not" actually mean? The green SNMP availability icon lights up for a host that should be offline?? You have a trigger that uses item with "zabbix[host, snmp, available]" key and it does not fire because Zabbix thinks the host is alive?
Maybe we step here on some unknown operands? https://www.zabbix.com/documentation...known-operands

Availability should only be "available" when communication is possible.. If you say that even for a offline host its "possible", maybe something else is answering your calls... Some weird NAT config or bad dns, whatever...
Try to capture some network traffic with tcpdump and analyze it.

[BobMart]

Sorry for my late reply.
So zabbix[host, snmp, available]" key returns "1 - available" will return "0 - unavailable" after 15s if interface is unreached ?

The green SNMP availability icon lights up for a host that should be offline?? You have a trigger that uses item with "zabbix[host, snmp, available]" key and it does not fire because Zabbix thinks the host is alive?.

Yes, the icone stays green and zabbix[host, snmp, available]" key returns "1 - available".

Maybe we step here on some unknown operands? https://www.zabbix.com/documentation...known-operands

The key was already created by zabbix, I didn't edit it. What do you mean ?

If you say that even for a offline host its "possible", maybe something else is answering your calls...Some weird NAT config or bad dns, whatever...
Try to capture some network traffic with tcpdump and analyze it.

Yes, that exactly what I mean. But as zabbix returns "0 - down" for ping, there should be no issue there, right ?

[PeterZielony]

Sorry for my late reply. So zabbix[host, snmp, available]" key returns "1 - available" will return "0 - unavailable" after 15s if interface is unreached ?


Yes, the icone stays green and zabbix[host, snmp, available]" key returns "1 - available".


The key was already created by zabbix, I didn't edit it. What do you mean ?

Yes, that exactly what I mean. But as zabbix returns "0 - down" for ping, there should be no issue there, right ?

Just becouse something not responding to ping doesnt mean it is not there.

Like suggested get wireshark and get some packets - it is possible that there might another device on same ip(or dns if you use it as name) that responds to snmp or it could be something like routing that "intercepts" packets (not nessesery malicious).



zabbix[host, snmp, available] item calculated is based on response from interface from other side based on (and calculated from) snmp calls. Same for agent ping - this isn't real icmp "ping" but poking if agents responds "yes im there" but using agent port - same for snmp

See if you can reach device (when it is offline) using some snmp walkers to make sure there isnt anything that actually responds on snmp port (from monitoring point eq zabbix server/proxy)
(and get wireshark to make sure)

[BobMart]

Just becouse something not responding to ping doesnt mean it is not there.

Like suggested get wireshark and get some packets - it is possible that there might another device on same ip(or dns if you use it as name) that responds to snmp or it could be something like routing that "intercepts" packets (not nessesery malicious).

I'm sure "it wasn't there" as link was down. I don't think there is another equipment with same IP address as we built the network by our own so know it well. I ask only by IP address, not domain name. And if I change now to change the community (to simulate a lost by SNMP), it works fine. It seems the issue only occurs when the link is down (so SNMP and PING lost at the same time).

See if you can reach device (when it is offline) using some snmp walkers to make sure there isnt anything that actually responds on snmp port (from monitoring point eq zabbix server/proxy)
(and get wireshark to make sure)

It didn't work with snmpwalk as link was down, but I can test with wireshark next time to be sure.