Zabbix 5.4.8 False High Bandwidth Monitoring

[Markku]

Right, so it is somewhat better ASIC than in 93180YC-FX (for example https://www.ciscolive.com/c/dam/r/ci...RKDCN-3222.pdf slides 13, 46-51)

Markku

[RadicalEd]

I've opened a ticket at Cisco, lets see what they're saying.

Maybe it's a bug of a library that other vendors are also using?

[RadicalEd]

For Cisco it's a known bug:

CSCwa91783 : Bug Search Tool (cisco.com)

Symptom: An N9K switch may show abnormally high input or output traffic rates on its interface, in the order of tens of terabits per second. This is observed in "show interface" as well as SNMP polling. This does not cause any problems beyond incorrect counters.

Conditions: This problem has been observed after an upgrade.

Workaround: It's been observed that the problem may return after "reload" and even "reload ascii". No reliable workaround available other than upgrading to a fixed version.

[d1mkou]

Hello,

We have the same problem with Juniper QFX5100 (Junos 18.1R3-S6.1) on Zabbix 6.0.2.
On our device we have multiple 20gbit LAG interfaces, but only one member xe-0/0/1 shows strange results like 4Tbps or 11Tbps.

With Cacti we don't observe such behavior.

[mdw]

I just want to raise a "me too". Seems to be limited to Cisco Nexus 9000 series, but the numbers are utterly bonkers. Sometimes I even see petabits per second (our biggest interfaces are 100G). It's utterly broken at the moment. I verified my configuration and there's nothing obviously wrong.

[Markku]

mdw are you saying that the versions listed as Fixed have not fixed it for you, or are you unable to upgrade to the recommended (and fixed) NX-OS version?

Markku

[mdw]

mdw are you saying that the versions listed as Fixed have not fixed it for you, or are you unable to upgrade to the recommended (and fixed) NX-OS version?

Markku

I must have missed, something. Can you point me in the right direction? We're running on 5.0 however.

[Markku]

There is the link to the Cisco bug above, it says that it is fixed in NX-OS 10.2(4) (among other versions) that is one of the recommended releases for Nexus 9000: https://www.cisco.com/c/en/us/td/doc..._Switches.html

Markku

[mdw]

There is the link to the Cisco bug above, it says that it is fixed in NX-OS 10.2(4) (among other versions) that is one of the recommended releases for Nexus 9000: https://www.cisco.com/c/en/us/td/doc..._Switches.html

Markku

Hm, don't think that's going to happen soon. We've been through two rounds of NX-OS upgrades and I don't think anyone is eager for another one. Also, interestingly, one of the hosts where I notice this issue is actually running the ACI software, not NX-OS.

[ZigbeeZabbix]

Was this issue determined to be a vendor issue or a zabbix issue? We are seeing the same issue on newly added Fortiswitch devices where the management interfaces are reporting high error rates and bandwidth utilization in the 100s of Mbits (and even Gbit once in a while). Zabbix 6.4.11. Issue hasn't occurred in the past. Roughly 25 switches in the system and only occurs on these two new switches (running the same firmware and configuration as the other switches). Unchecked bulk requests, no change in behavior.

[jeschebach]

I have a similar issue, with Zabbix 6.0.13. I have a virtual interface with outbound traffic peaks > 300Gbits, the interface BW is 100 Gbit. Is this an expected behavior? Can anyone help me understand how Zabbix calculates the values in the Network traffic graph for Juniper devices? I can notice in the template it uses the ifHCInOctets, ifHCOutOctets OIDs, among others, but how is the information interpreted given that the device reports totals for each OID?

Template link: https://git.zabbix.com/projects/ZBX/...mp.yaml#965

Thanks!

[Markku]

You can check the item configuration, the preprocessing rules. The item takes the counter value (bytes), multiplies it with 8 (to get bits), then calculates the difference from the previous value, and divides it with the item interval to get the value as bits per second.

If I had a switch that shows that kind of incorrect peaks (and didn't have firmware bug information yet), I'd just capture the SNMP traffic and see the values myself, if there are problems in the returned values or not. And then open an issue to the vendor if needed.

Markku

[gonzalezcantarell]

I have a similir problema, actually works with the template Fortigate by SNMP but I see the trigger never works or alert when the bandwidth raise to 50%. Modify the trigger host, change the value of the macros to 50% in 5 minutes but doesn´t works. Do you know what value need to modify to works this trigger