5412zl Network Traffic spikes over physical speed

[TimGuyUK]

Hi Guys

I don't know if I'm exhibiting a fault with the switch or that the readings into zabbix are wrong.

A 10Gb edge switch connected to the core HP 5412zl chassis is showing 50Gbps spikes for a 5min period of time. Random 10Gb ports, and never 1Gb ports.

The 10Gb port on the edge switch isn't showing the same traffic.

I thought first of all that maybe the spanning tree was catching a loop and that the traffic was a symptom of that but the logs of the 5412zl aren't showing a spanning tree change at that stage.

The users do not report issues.

Has anyone seen this monitoring 10Gb ports on HP or any other switch for that matter.

Example

http://www.timguy.net/Pictures/zabbix/5400highbandwidth.jpg

(wouldn't embbed for some reasons, sorry)

[troffasky]

Are you using 64- or 32-bit counters? 32-bit counters can overflow long before the 5 minute poll interval.

[TimGuyUK]

Are you using 64- or 32-bit counters? 32-bit counters can overflow long before the 5 minute poll interval.

I believe I'm using 64bit counters. According to this:

https://support.zabbix.com/browse/ZBXNEXT-2188

Template Module Interfaces SNMPv2 with 64bit counters**
Template Module Interfaces Simple SNMPv2 with 32bit counters

**I'm using this discovery template.

Maybe I need to lower the poll interval?

Tim

[kloczek]

if{In,Out}Octets are 32-bit counters.
You must use ifHC{In,Out}Octets.

[TimGuyUK]

if{In,Out}Octets are 32-bit counters.
You must use ifHC{In,Out}Octets.

I'm pretty sure that bits ok. This is one of the Interfaces playing up.

Problem: (CORE SWITCH 5400:net.if.in[ifHCInOctets.128].avg(15m)}>({$IF_UTIL_MAX:"F8"}/100)*{CORE SWITCH 5400:net.if.speed[ifHighSpeed.128].last()} or {CORE SWITCH 5400:net.if.out[ifHCOutOctets.128].avg(15m)}>({$IF_UTIL_MAX:"F8"}/100)*{CORE SWITCH 5400:net.if.speed[ifHighSpeed.128].last()}) and {CORE SWITCH 5400:net.if.speed[ifHighSpeed.128].last()}>0

[ic1sys]

I have the same problem. Could you resolve it?
In order to add some extra info, the following lines are an extract from the values recorded:

2018-04-22 17:40:20	15889608
2018-04-22 17:37:20	12287144
2018-04-22 17:34:20	14613408
2018-04-22 17:31:20	2193134470720
2018-04-22 17:25:20	14828584
2018-04-22 17:22:20	13441736
2018-04-22 17:19:20	13144448

Values are recorded in 3-minutes intervals and the wrong value is happened after a missing interval

[zimeon]

Same issue here with Template Module Interfaces SNMPv2 and HP J8697A Switch 5406zl models. The 10G interfaces spike up to 50G according to collected data and trigger the port utilization alerts incorrectly.

[TimGuyUK]

Can I bump this, maybe someone could tell us, is this a bug with regards to just the HP5400 and its snmp or is this an issue with zabbix and how it reports 10Gb ports in general. Should we be raising a ticket or is there some configuration we can look at to resolve the issue ourselves?


Thanks

Tim

[ic1sys]

My switch is a Supermicro SSE-X24S...

[kloczek]

if someone is not happy with standard zabbix templates you can try to use my templates which are using MIB based approach

https://github.com/kloczek/zabbix-templates/tree/master/MIB

https://github.com/kloczek/zabbix-templates/tree/master/SNMP%20Devices

[zimeon]

Created a ticket about this; https://support.zabbix.com/browse/ZBX-14318