SNMP bulk request efficiency gain pitfalls

[nc-pv]

I have been playing with monitoring of Cisco SG-300 series switches recently and discovered that using the bulk request feature increases the CPU load on the switches.

The CPU load reads 10% with the bulk requests enabled and it drops down to 5% when not using bulk requests.

While the documentation mentions that bulk requests increase efficiency (perhaps on the server side), users should be aware that it might be less efficient for the monitored devices.

https://www.zabbix.com/documentation/5.0/manual/config/items/itemtypes/snmp:

Zabbix server and proxy daemons query SNMP devices for multiple values in a single request. This affects all kinds of SNMP items (regular SNMP items, SNMP items with dynamic indexes, and SNMP low-level discovery) and should make SNMP processing much more efficient.

[Hamardaban]

Efficiency is considered from the point of view of zabbix. And it is achieved due to a greater load on the equipment. So everything is logical :-)

[yurtesen]

It probably uses less CPU in your switch also. You see momentary peak only. This is because more values are queried simultaneously. The operation takes less time but functions more intensely.

You should probably also see:

https://www.zabbix.com/documentation/5.0/manual/config/items/itemtypes/snmp#internal_workings_of_bulk_processing

Also keep in mind that snmp v1 and v2 work slightly differently when it comes to bulk processing and zabbix tries to find the maximum size at first.

[nc-pv]

It probably uses less CPU in your switch also. You see momentary peak only. This is because more values are queried simultaneously. The operation takes less time but functions more intensely.

Yurtesen, This explanation is reasonable.

I run a test by enabling the bulk mode on the interface and watching with tcpdump when Zabbix requests the data from the switch. In between of these checks I was retrieving the CPU utilization reading with snmpget (just one value).

On average it was 8% (vs 5% without bulk mode, vs 10% value obtained by Zabbix in bulk mode).

But your explanation still makes sense, because the switch reports average CPU utilization.

Anyway, this is not a problem, because even the 10% CPU usage is well within normal operational range.