Wrong read SNMP values

[jurica]

Hello everyone,
firstly I want to apologize for my poor English, I hope you will understand me.

I am trying to set up watch on our Checkpoint firewall in Zabbix using SNMP protocol v2 and I have some troubles with that. I tried to read two values and both had different problems.

CPU usage:
I set the item using OID 1.3.6.1.4.1.2620.1.6.7.2.4.0 to monitor CPU usage. This value can range from 0-100 but in latest data and in graph I only saw 0 (SNMP was succesfully connected). When I try read this value by snmpget the values were different. I set the update interval to 1 second...

Total RAM size:
I have successfully read the value with OID 1.3.6.1.4.1.2620.1.6.7.4.3.0 but it is not complete in Zabbix. In Zabbix I see 21181685 (does not matter on format, in bytes it is also small so I tried read it raw as text). When I use "snmpget -v 2c -c cstring address 1.3.6.1.4.1.2620.1.6.7.4.3.0" on same machine I got 2118168576.

Can you help me with that, please?

---

I tried to run tcpdump on the machine where our Zabbix server is running and it seems ok.

root@zabbix:~# tcpdump 'port 161' | grep "2620"
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on ens3, link-type EN10MB (Ethernet), capture size 262144 bytes
13:50:21.164482 IP 10.9.2.5.42628 > 10.20.0.2.snmp: C="..." GetRequest(52) E:2620.1.6.7.2.4.0 E:2620.1.6.7.4.3.0
13:50:21.166417 IP 10.20.0.2.snmp > 10.9.2.5.42628: C="..." GetResponse(63) E:2620.1.6.7.2.4.0=1 E:2620.1.6.7.4.3.
0="2118168576"
13:50:22.310505 IP 10.9.2.5.52321 > 10.20.0.2.snmp: C="..." GetRequest(52) E:2620.1.6.7.2.4.0 E:2620.1.6.7.4.3.0
13:50:22.311476 IP 10.20.0.2.snmp > 10.9.2.5.52321: C="..." GetResponse(63) E:2620.1.6.7.2.4.0=1 E:2620.1.6.7.4.3.
0="2118168576"
13:50:23.762218 IP 10.9.2.5.48900 > 10.20.0.2.snmp: C="..." GetRequest(52) E:2620.1.6.7.2.4.0 E:2620.1.6.7.4.3.0
13:50:23.763851 IP 10.20.0.2.snmp > 10.9.2.5.48900: C="..." GetResponse(63) E:2620.1.6.7.2.4.0=0 E:2620.1.6.7.4.3.
0="2118168576"
13:50:24.874842 IP 10.9.2.5.58201 > 10.20.0.2.snmp: C="..." GetRequest(52) E:2620.1.6.7.2.4.0 E:2620.1.6.7.4.3.0
13:50:24.875841 IP 10.20.0.2.snmp > 10.9.2.5.58201: C="..." GetResponse(63) E:2620.1.6.7.2.4.0=0 E:2620.1.6.7.4.3.
0="2118168576"
13:50:25.973172 IP 10.9.2.5.60047 > 10.20.0.2.snmp: C="..." GetRequest(52) E:2620.1.6.7.2.4.0 E:2620.1.6.7.4.3.0
13:50:25.974850 IP 10.20.0.2.snmp > 10.9.2.5.60047: C="..." GetResponse(63) E:2620.1.6.7.2.4.0=2 E:2620.1.6.7.4.3.
0="2118168576"
13:50:27.006837 IP 10.9.2.5.51083 > 10.20.0.2.snmp: C="..." GetRequest(52) E:2620.1.6.7.2.4.0 E:2620.1.6.7.4.3.0
13:50:27.008512 IP 10.20.0.2.snmp > 10.9.2.5.51083: C="..." GetResponse(63) E:2620.1.6.7.2.4.0=1 E:2620.1.6.7.4.3.
0="2118168576"

[Hamardaban]

"Wonderful are thy works Lord"...... CPU usage > 1.3.6.1.4.1.2620.1.6.7.2.4.0 - integer.... Total real memory >1.3.6.1.4.1.2620.1.6.7.4.3.0 - memTotalReal64... What "type of information" do you use? Are there any "interesting" messages in the logs? Check that there are no preprocessing rules.

[jurica]

Thank you kindly Hamardaban! I cloned and modified one template and on my items really were some preprocessing rules. So now is everything ok.

[ingus.vilnis]

I'd suggest to avoid those short 1 second update intervals particularly on SNMP as those poor snmp engines will not be able to return values anyways. 1 minute in normal circumstances is more than enough.

And for CheckPoint device CPU utilization you might want to look into each core individually too, as the 1.3.6.1.4.1.2620.1.6.7.2.4.0 just gives you the average utilization across all cores while in the reality there are some cores fully stressed while others are idle.