Ubuntu 18.04 Bionic Beaver, Zabbix 3.4.8 from source- Server drops pings

[kmstrube81]

I am running a zabbix server that is monitoring about 150 hosts. Approximately 100 are windows PCs monitored via the zabbix agent and about 50 are routers/switches/printers monitored by SNMP+ICMP. I get a crazy amount of 'ICMP unavailable' alerts for these 50 SNMP/ICMP hosts. Almost always they are false positive and they are actually up.

I am running zabbix on a hyper-V VM and none of the other VMs have trouble pinging hosts on the network. Its only on the zabbix VM that it has trouble pinging. If i stop the zabbix_server service then the VM can ping hosts just normal but while zabbix_server is running it will randomly drop pings. I have StartPingers in the server.conf set to 15. If there is anymore info you need to help troubleshoot let me know. Thanks in advanced!

[dimir]

15 pingers can be not enough if delay is small. I would add internal check that would be monitoring busy pinger processes ( https://www.zabbix.com/documentation...types/internal ) and see if they are all the time busy.

Also take a look at parameters of icmpping item ( https://www.zabbix.com/documentation.../simple_checks ) to understand how many seconds does a pinger need to process one check.

[kmstrube81]

The pinger process busy percentage sits around 15% give or take 2.5%. The fping script doesn't specify a timeout so it uses the default setting of 1000ms and my server config uses the default time out of 4 seconds so there shouldn't be much of a discrepancy there with the check timing out before the ping is finished. Just in case I'll set the interval for fping to 800ms. The VM and physcial NIC aren't being pushed very hard so I'm at a loss why the pings drop.

[dimir]

Did you try icmppingloss?

[kmstrube81]

It doesn't have any special parameters in the item configuration either

[kernbug]

I am running a zabbix server that is monitoring about 150 hosts. Approximately 100 are windows PCs monitored via the zabbix agent and about 50 are routers/switches/printers monitored by SNMP+ICMP. I get a crazy amount of 'ICMP unavailable' alerts for these 50 SNMP/ICMP hosts. Almost always they are false positive and they are actually up.

It's very unusual for 150 hosts, but you can try this in your sysctl configuration file:

net.ipv4.icmp_ratelimit = 10000
net.ipv4.icmp_ratemask = 6168

Also to reduce load for iptables (if using it), you can add to your firewall this:

# for the raw table
# ICMP-notrack
-A PREROUTING -s x.x.x.x/y -p icmp --icmp-type echo-request -j NOTRACK
-A PREROUTING -s x.x.x.x/y -p icmp --icmp-type echo-reply -j NOTRACK
-A OUTPUT -d x.x.x.x/y -p icmp --icmp-type echo-request -j NOTRACK
-A OUTPUT -d x.x.x.x/y -p icmp --icmp-type echo-reply -j NOTRACK

# for filter table
# OUT-for-notrack
-A OUTPUT -d x.x.x.x/y -p icmp --icmp-type echo-request -j ACCEPT
-A OUTPUT -d x.x.x.x/y -p icmp --icmp-type echo-reply -j ACCEPT

Also check network interface for errors or buffer overflows, irq processing.