Hello Adam,
 
 
Thank you very much for the quick response. I have a minor thing to confirm please just to be sure. 
 
There are 3 cpu related charts in Observium for SRX1500 (in standalone configuration). 

Can you please confirm that the chart which is described in Observium as "SPC slot 0"  is the one that corresponds to OID  .1.3.6.1.4.1.2636.3.39.1.12.1.1.1.3?
 
 
For reference:
user@fw00> show snmp mib get .1.3.6.1.4.1.2636.3.39.1.12.1.1.1.4.0     
jnxJsSPUMonitoringCPUUsage.0 = 0
 
Thank you again, 
Al. 
 


From: Adam Armstrong <adama@observium.org>
To: observium@observium.org
Sent: Tuesday, October 24, 2017 5:24 AM
Subject: Re: [Observium] Juniper SRX1500 firewall questionable CPU OIDs used

Hi,

We already discover and poll these processors correctly. If you don't want alerts for specific types of processor, filter them in your alert checker config.

Observium is only generating alerts for the things you have told it to generate alerts for.

For example : 

+------------------------+-------+---------+-------+
| Label                  | Type  | Index   | Usage |
+------------------------+-------+---------+-------+
| node0 FPC: FPC @ 0/*/* | junos | 7.1.0.0 | 0%    |
| node0 FPC: FPC @ 2/*/* | junos | 7.3.0.0 | 0%    |
| node0 Routing Engine   | junos | 9.1.0.0 | 34%   |
| node0 SPC slot 0       | junos | 0       | 0%    |
| node1 SPC slot 0       | junos | 18      | 0%    |
+------------------------+-------+---------+-------+

The first 3 are jnxOperatingCPU:

jnxOperatingDRAMSize.7.1.0.0 = 0
jnxOperatingDRAMSize.7.3.0.0 = 0
jnxOperatingDRAMSize.9.1.0.0 = 0
jnxOperatingDescr.7.1.0.0 = node0 FPC: FPC @ 0/*/*
jnxOperatingDescr.7.3.0.0 = node0 FPC: FPC @ 2/*/*
jnxOperatingDescr.9.1.0.0 = node0 Routing Engine

The final 2 are jnxJsSPUMonitoringCPUUsage (the OID you give above):

jnxJsSPUMonitoringNodeDescr.0 = node0
jnxJsSPUMonitoringNodeDescr.18 = node1
jnxJsSPUMonitoringCPUUsage.0 = 0
jnxJsSPUMonitoringCPUUsage.18 = 0

Unfortunately for legacy reasons they have the same type of "junos", which may make it slightly more complex to filter them.

adam.
On 2017-10-23 15:12:08, aas029 <aas029@yahoo.com> wrote:

Hello, 



I have Juniper SRX1500 firewalls for which Observium is sending false positive CPU alerts (example included below) based on feedback from Juniper.

More specifically, I was told that the OIDs used by Observium to collect CPU information are not the correct ones for this devices in particular. 
Here are the OIDs that I was told should be used to monitor the data plane CPU usage (instead of the standard OIDs that poll the kernel):
.1.3.6.1.4.1.2636.3.39.1.12.1.1.1
Or more specifically for forwarding plane flow (SPU) only:
.1.3.6.1.4.1.2636.3.39.1.12.1.1.1.3"

Here is an Observium alert example:

Alert
Juniper Firewall CPU Usage is over 40%!
Entity
FPC: FEB @0/*/* 
Conditions
processor_usage gt 40 (49)
Metrics
processor_usage = 49
Duration
4m 19s (2017-10-22 17:22:53)
Device
Device
host.mine
Hardware
SRX1500
Operating System
Juniper JunOS 15.1X49-D50.3 Internet Router
Location
lab
Uptime
27 days, 12h 3m 4s

The above alert is seen several times a day per device. I'm currently running version 17.10.8921 (Linux 2.6.32-642.13.1.el6.x86_64 [amd64]) but have seen this with different frequencies on all other versions I had. 

Appreciate any information on potential fix or workaround or feedback on the Juniper response. 

Thanks,
Al. 


_______________________________________________
observium mailing list
observium@observium.org
http://postman.memetic.org/cgi-bin/mailman/listinfo/observium