This happens alot on devices who are bad at SNMP, sometimes they just seem to fail to respond to certain tables. In your case the interface speed gets changed which causes the %-load on the interface calculation to be wrong and triggers the alarm. My solution for traffic alarms like this is to use the "delay"-option in the alarm checker, then the alarm will only trigger if a devices interface is over the threshold for 2(or more) polls in a row.
/Markus
2016-11-30 14:50 GMT+01:00 Adam Armstrong adama@memetic.org:
I'm not sure, why would an SNMP walk from your server across your network to your device fail?
adam.
Sent from Mailbird http://www.getmailbird.com/?utm_source=Mailbird&utm_medium=email&utm_campaign=sent-from-mailbird
On 30/11/2016 13:46:13, Youssef BENGELLOUN - ZAHR ybzahr@prodware.fr wrote:
Dear Adam,
Shortly after that, observium detected that device went down due to SNMP being unreachable. Which isn’t true…
Question is : considering that the device is basically doing nothing, why would the SNMP walk fail ?
Thank you for the feedback.
Best regards.
*Youssef BENGELLOUN - ZAHR* - Consultant Expert Prodware France T : +33 979 999 000 - F : +33 988 814 001 - ybzahr@prodware.fr
Web : prodware.fr http://www.prodware.fr
http://twitter.com/Prodware/ http://www.facebook.com/Prodware/ https://www.linkedin.com/company/prodwarefrance https://www.youtube.com/c/ProdwareFrance http://www.viadeo.com/fr/company/prodware http://www.prodware.fr/social-network/
*De : *observium observium-bounces@observium.org au nom de Adam Armstrong adama@memetic.org *Répondre à : *Observium Network Observation System < observium@observium.org> *Date : *mercredi 30 novembre 2016 14:42 *À : *"observium@observium.org" observium@observium.org *Objet : *Re: [Observium] Salvo of false alerts
This happens when a device fails to correctly respond to an SNMP walk.
adam.
Sent from Mailbird http://www.getmailbird.com/?utm_source=Mailbird&utm_medium=email&utm_campaign=sent-from-mailbird
On 30/11/2016 13:37:12, Youssef BENGELLOUN - ZAHR ybzahr@prodware.fr wrote:
Dear Community,
I received a salvo of false alerts from an HP switch for all its’ interfaces :
Alert checker is pretty standard, it raises an alarm if an interface using over 90% of its’ bandwidth :
If I look at the eventlogs from the device, I can see a number of events (common to all interfaces) indicating the following :
2016-11-30 14:11:20 Interface changed: [ifAlias] X.X.X.X' -> NULL; [ifHighSpeed] '1000' -> NULL; [ifPromiscuousMode] 'true' -> NULL; [ifConnectorPresent] 'true' -> NULL
then, a few minutes later after the poller runs a new cycle :
2016-11-30 14:16:05 Interface changed: [ifAlias] '' -> 'X.X.X.X'; [ifHighSpeed] '' -> '1000'; [ifPromiscuousMode] '' -> 'true'; [ifConnectorPresent] '' -> 'true'
In the end, all alarms cleared out.
I’m curious to understand why observium would react in such a way. Any one could shed some light ?
Thank you.
*Youssef BENGELLOUN - ZAHR* - Consultant Expert Prodware France T : +33 979 999 000 - F : +33 988 814 001 - ybzahr@prodware.fr
Web : prodware.fr http://www.prodware.fr
http://twitter.com/Prodware/ http://www.facebook.com/Prodware/ https://www.linkedin.com/company/prodwarefrance https://www.youtube.com/c/ProdwareFrance http://www.viadeo.com/fr/company/prodware http://www.prodware.fr/social-network/
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium