On 20 Oct 2019, at 16:49, "Ryan, Spencer via observium" <observium@observium.org> wrote:

Since updating to 10134 we’ve seen some odd behavior out of our high interface utilization alerts.

 

The alert itself is very simple, device matches *, entity is ifType equals ethernetCsmacd, and the test conditions are any of:

 

ifInOctets_perc ge 80
ifOutOctets_perc ge 80

 

Which has worked fine forever.

 

Now it’s throwing alarms on an odd mix of devices (UBNT, Palo Alto, Arista, Kemp VLM, Infoblox) for ports that are down/down loopbacks or HA interfaces not connected.

 

All of the ports it is alarming on show this in the data (Speed 0, and down/down):

 

ifSpeed=>0

ifHighSpeed=>0

ifOperStatus=>down

ifAdminStatus=>down

 

 

Any idea what changed or why it’s alarming on these now? I’m guessing its trying to do the 80% math on….0 but I’d imagine that shouldn’t even run if the port is admin+operationally down.

 

This is a mgmt interface on an arista (which is unconnected and admin down):

 

https://pastebin.com/JsNvre40

 

As you can see the *_perc calcs are 0, it almost seems some kind of divide by 0 error.

 

Thanks in advance!

 

Spencer Ryan | Senior Systems Administrator | spencer.ryan@netscout.com

Arbor Networks | The security division of NETSCOUT

+1.734.794.5033 (d) | +1.734.846.2053 (m)

www.arbornetworks.com

 

observium mailing list
observium@observium.org
http://postman.memetic.org/cgi-bin/mailman/listinfo/observium