Discards reporting incorectly
Hi,
We have noticed an interesting problem where on all of our OpenBSD firewalls, every single interface on the same firewall reports the same discards rate.
We would like to try and work out which interface these discards are actually happening on, so we can work out what the cause is and check for a possible remedy (wrong VLANs being trunked through for example). If they are bad checksums, than that's ok. But would like to know ;)
Below is a screenshot showing the "Errors" graphs for all ports on the same server, notice how they are all displaying the same data.
My thoughts of how to start are; What is the SNMP OID being polled for this information?
I wonder if OpenBSD is incorrectly reporting the same value on all interfaces, or if there is only a single Discards counter/OID for the whole system, or if it is an Observium problem etc..
So if anyone can tell me the OID, I can do some more investigation first ;) I don't mind setting up OID mappings in SNMPD etc, if that is required I would be happy to provide a configuration template for Observium and OpenBSD. And I also wonder how up to date the OpenBSD MIB file built into Observium is?
Thanks in advance for your help :) Kind regards, Andy.
There's virtually no chance of this bring anything other than net SNMP on openbsd rather helpfully reporting the same ifInDiscards ifOutDiscards counters for all interfaces.
What version of net-snmp is it?
Adam.
Sent from BlueMail
On 24 May 2016, 14:31, at 14:31, Andy Lemin andy@brandwatch.com wrote:
Hi,
We have noticed an interesting problem where on all of our OpenBSD firewalls, every single interface on the same firewall reports the same discards rate.
We would like to try and work out which interface these discards are actually happening on, so we can work out what the cause is and check for a possible remedy (wrong VLANs being trunked through for example). If they are bad checksums, than that's ok. But would like to know ;)
Below is a screenshot showing the "Errors" graphs for all ports on the same server, notice how they are all displaying the same data.
My thoughts of how to start are; What is the SNMP OID being polled for this information?
I wonder if OpenBSD is incorrectly reporting the same value on all interfaces, or if there is only a single Discards counter/OID for the whole system, or if it is an Observium problem etc..
So if anyone can tell me the OID, I can do some more investigation first ;) I don't mind setting up OID mappings in SNMPD etc, if that is required I would be happy to provide a configuration template for Observium and OpenBSD. And I also wonder how up to date the OpenBSD MIB file built into Observium is?
Thanks in advance for your help :) Kind regards, Andy.
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
Yea I figured the same which is why I was after the OID being called?
Does anyone know? Or know how to find out? Where to look?
OpenBSD actually runs its own SNMPD (not net-snmpd). In the past net-snmpd gave you all the generic stuff, but nothing from the OpenBSD enterprise. And SNMPD gave you everything from the OpenBSD enterprise, but not the general stuff.
So I have seen people running net-snmpd on the interfaces, and SNMPD only on the loopback, then setting up an OID forwarder within net-snmp to forward all OpenBSD enterprise OIDs to the localhost etc. This kinda worked but was fragmented and had issues and data holes.. :(
However a year ago or so, SNMPD was significantly extended so that it now provides everything net-snmpd does, and so we only run SNMPD. If SNMPD is returning the wrong value somewhere, then I can definitely take that to the OpenBSD guys.
But before I can I need to know the OID Observium is calling ;)
Also seeing as SNMPD was extended, I think making sure Observium has the latest OpenBSD MIB's could be important.
Thanks, Andy.
On Tue, May 24, 2016 at 2:33 PM, Adam Armstrong adama@memetic.org wrote:
There's virtually no chance of this bring anything other than net SNMP on openbsd rather helpfully reporting the same ifInDiscards ifOutDiscards counters for all interfaces.
What version of net-snmp is it?
Adam.
Sent from BlueMail http://www.bluemail.me/r
On 24 May 2016, at 14:31, Andy Lemin andy@brandwatch.com wrote:
Hi,
We have noticed an interesting problem where on all of our OpenBSD firewalls, every single interface on the same firewall reports the same discards rate.
We would like to try and work out which interface these discards are actually happening on, so we can work out what the cause is and check for a possible remedy (wrong VLANs being trunked through for example). If they are bad checksums, than that's ok. But would like to know ;)
Below is a screenshot showing the "Errors" graphs for all ports on the same server, notice how they are all displaying the same data.
My thoughts of how to start are; What is the SNMP OID being polled for this information?
I wonder if OpenBSD is incorrectly reporting the same value on all interfaces, or if there is only a single Discards counter/OID for the whole system, or if it is an Observium problem etc..
So if anyone can tell me the OID, I can do some more investigation first ;) I don't mind setting up OID mappings in SNMPD etc, if that is required I would be happy to provide a configuration template for Observium and OpenBSD. And I also wonder how up to date the OpenBSD MIB file built into Observium is?
Thanks in advance for your help :) Kind regards, Andy.
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
I already gave you the two OIDs in the previous mail.
The existence or not of openbsd specific MIBs are irrelevant in this instance, since its using IF-MIB (also, MIBs don't really do what you think they do)
Adam.
Sent from BlueMail
On 24 May 2016, 18:14, at 18:14, Andy Lemin andy@brandwatch.com wrote:
Yea I figured the same which is why I was after the OID being called?
Does anyone know? Or know how to find out? Where to look?
OpenBSD actually runs its own SNMPD (not net-snmpd). In the past net-snmpd gave you all the generic stuff, but nothing from the OpenBSD enterprise. And SNMPD gave you everything from the OpenBSD enterprise, but not the general stuff.
So I have seen people running net-snmpd on the interfaces, and SNMPD only on the loopback, then setting up an OID forwarder within net-snmp to forward all OpenBSD enterprise OIDs to the localhost etc. This kinda worked but was fragmented and had issues and data holes.. :(
However a year ago or so, SNMPD was significantly extended so that it now provides everything net-snmpd does, and so we only run SNMPD. If SNMPD is returning the wrong value somewhere, then I can definitely take that to the OpenBSD guys.
But before I can I need to know the OID Observium is calling ;)
Also seeing as SNMPD was extended, I think making sure Observium has the latest OpenBSD MIB's could be important.
Thanks, Andy.
On Tue, May 24, 2016 at 2:33 PM, Adam Armstrong adama@memetic.org wrote:
There's virtually no chance of this bring anything other than net
SNMP on
openbsd rather helpfully reporting the same ifInDiscards
ifOutDiscards
counters for all interfaces.
What version of net-snmp is it?
Adam.
Sent from BlueMail http://www.bluemail.me/r
On 24 May 2016, at 14:31, Andy Lemin andy@brandwatch.com wrote:
Hi,
We have noticed an interesting problem where on all of our OpenBSD firewalls, every single interface on the same firewall reports the
same
discards rate.
We would like to try and work out which interface these discards are actually happening on, so we can work out what the cause is and
check for a
possible remedy (wrong VLANs being trunked through for example). If
they
are bad checksums, than that's ok. But would like to know ;)
Below is a screenshot showing the "Errors" graphs for all ports on
the
same server, notice how they are all displaying the same data.
My thoughts of how to start are; What is the SNMP OID being polled for this information?
I wonder if OpenBSD is incorrectly reporting the same value on all interfaces, or if there is only a single Discards counter/OID for
the whole
system, or if it is an Observium problem etc..
So if anyone can tell me the OID, I can do some more investigation
first
;) I don't mind setting up OID mappings in SNMPD etc, if that is
required I
would be happy to provide a configuration template for Observium and OpenBSD. And I also wonder how up to date the OpenBSD MIB file built into Observium is?
Thanks in advance for your help :) Kind regards, Andy.
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
Hi Adam,
Thanks for your reply.
I'm not sure if it is my email client or something, but I honestly cannot see the OID in your email? ( have expanded every block and I cannot see it ).
This is the entirety of your email; "There's virtually no chance of this bring anything other than net SNMP on openbsd rather helpfully reporting the same ifInDiscards ifOutDiscards counters for all interfaces. What version of net-snmp is it?
Adam.
Sent from BlueMail http://www.bluemail.me/r"
Hence why I asked again? :( Could you please sent it over once more?
If I have got my wires crossed about what MIBs, do you know of a good source to read? I have already done a lot of reading in the past on SNMP, but if I have misunderstood something (which is fine) it just means I need to find a better source of information on the internet to read.
Thanks for your time and help. Cheers, Andy.
On Tue, May 24, 2016 at 7:49 PM, Adam Armstrong adama@memetic.org wrote:
I already gave you the two OIDs in the previous mail.
The existence or not of openbsd specific MIBs are irrelevant in this instance, since its using IF-MIB (also, MIBs don't really do what you think they do)
Adam.
Sent from BlueMail http://www.bluemail.me/r
On 24 May 2016, at 18:14, Andy Lemin andy@brandwatch.com wrote:
Yea I figured the same which is why I was after the OID being called?
Does anyone know? Or know how to find out? Where to look?
OpenBSD actually runs its own SNMPD (not net-snmpd). In the past net-snmpd gave you all the generic stuff, but nothing from the OpenBSD enterprise. And SNMPD gave you everything from the OpenBSD enterprise, but not the general stuff.
So I have seen people running net-snmpd on the interfaces, and SNMPD only on the loopback, then setting up an OID forwarder within net-snmp to forward all OpenBSD enterprise OIDs to the localhost etc. This kinda worked but was fragmented and had issues and data holes.. :(
However a year ago or so, SNMPD was significantly extended so that it now provides everything net-snmpd does, and so we only run SNMPD. If SNMPD is returning the wrong value somewhere, then I can definitely take that to the OpenBSD guys.
But before I can I need to know the OID Observium is calling ;)
Also seeing as SNMPD was extended, I think making sure Observium has the latest OpenBSD MIB's could be important.
Thanks, Andy.
On Tue, May 24, 2016 at 2:33 PM, Adam Armstrong adama@memetic.org wrote:
There's virtually no chance of this bring anything other than net SNMP on openbsd rather helpfully reporting the same ifInDiscards ifOutDiscards counters for all interfaces.
What version of net-snmp is it?
Adam.
Sent from BlueMail http://www.bluemail.me/r
On 24 May 2016, at 14:31, Andy Lemin andy@brandwatch.com wrote:
Hi,
We have noticed an interesting problem where on all of our OpenBSD firewalls, every single interface on the same firewall reports the same discards rate.
We would like to try and work out which interface these discards are actually happening on, so we can work out what the cause is and check for a possible remedy (wrong VLANs being trunked through for example). If they are bad checksums, than that's ok. But would like to know ;)
Below is a screenshot showing the "Errors" graphs for all ports on the same server, notice how they are all displaying the same data.
My thoughts of how to start are; What is the SNMP OID being polled for this information?
I wonder if OpenBSD is incorrectly reporting the same value on all interfaces, or if there is only a single Discards counter/OID for the whole system, or if it is an Observium problem etc..
So if anyone can tell me the OID, I can do some more investigation first ;) I don't mind setting up OID mappings in SNMPD etc, if that is required I would be happy to provide a configuration template for Observium and OpenBSD. And I also wonder how up to date the OpenBSD MIB file built into Observium is?
Thanks in advance for your help :) Kind regards, Andy.
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
Andy,
The oids are ifInDiscards and ifOutDiscards :-)
Tom
On 05/27/2016 12:06 PM, Andy Lemin wrote:
Hi Adam,
Thanks for your reply.
I'm not sure if it is my email client or something, but I honestly cannot see the OID in your email? ( have expanded every block and I cannot see it ).
This is the entirety of your email; "There's virtually no chance of this bring anything other than net SNMP on openbsd rather helpfully reporting the same ifInDiscards ifOutDiscards counters for all interfaces. What version of net-snmp is it?
Adam.
Sent fromBlueMail http://www.bluemail.me/r"
Hence why I asked again? :( Could you please sent it over once more?
If I have got my wires crossed about what MIBs, do you know of a good source to read? I have already done a lot of reading in the past on SNMP, but if I have misunderstood something (which is fine) it just means I need to find a better source of information on the internet to read.
Thanks for your time and help. Cheers, Andy.
On Tue, May 24, 2016 at 7:49 PM, Adam Armstrong <adama@memetic.org mailto:adama@memetic.org> wrote:
I already gave you the two OIDs in the previous mail. The existence or not of openbsd specific MIBs are irrelevant in this instance, since its using IF-MIB (also, MIBs don't really do what you think they do) Adam. Sent from BlueMail <http://www.bluemail.me/r> On 24 May 2016, at 18:14, Andy Lemin <andy@brandwatch.com <mailto:andy@brandwatch.com>> wrote: Yea I figured the same which is why I was after the OID being called? Does anyone know? Or know how to find out? Where to look? OpenBSD actually runs its own SNMPD (not net-snmpd). In the past net-snmpd gave you all the generic stuff, but nothing from the OpenBSD enterprise. And SNMPD gave you everything from the OpenBSD enterprise, but not the general stuff. So I have seen people running net-snmpd on the interfaces, and SNMPD only on the loopback, then setting up an OID forwarder within net-snmp to forward all OpenBSD enterprise OIDs to the localhost etc. This kinda worked but was fragmented and had issues and data holes.. :( However a year ago or so, SNMPD was significantly extended so that it now provides everything net-snmpd does, and so we only run SNMPD. If SNMPD is returning the wrong value somewhere, then I can definitely take that to the OpenBSD guys. But before I can I need to know the OID Observium is calling ;) Also seeing as SNMPD was extended, I think making sure Observium has the latest OpenBSD MIB's could be important. Thanks, Andy. On Tue, May 24, 2016 at 2:33 PM, Adam Armstrong <adama@memetic.org <mailto:adama@memetic.org>> wrote: There's virtually no chance of this bring anything other than net SNMP on openbsd rather helpfully reporting the same ifInDiscards ifOutDiscards counters for all interfaces. What version of net-snmp is it? Adam. Sent from BlueMail <http://www.bluemail.me/r> On 24 May 2016, at 14:31, Andy Lemin <andy@brandwatch.com <mailto:andy@brandwatch.com>> wrote: Hi, We have noticed an interesting problem where on all of our OpenBSD firewalls, every single interface on the same firewall reports the same discards rate. We would like to try and work out which interface these discards are actually happening on, so we can work out what the cause is and check for a possible remedy (wrong VLANs being trunked through for example). If they are bad checksums, than that's ok. But would like to know ;) Below is a screenshot showing the "Errors" graphs for all ports on the same server, notice how they are all displaying the same data. My thoughts of how to start are; What is the SNMP OID being polled for this information? I wonder if OpenBSD is incorrectly reporting the same value on all interfaces, or if there is only a single Discards counter/OID for the whole system, or if it is an Observium problem etc.. So if anyone can tell me the OID, I can do some more investigation first ;) I don't mind setting up OID mappings in SNMPD etc, if that is required I would be happy to provide a configuration template for Observium and OpenBSD. And I also wonder how up to date the OpenBSD MIB file built into Observium is? Thanks in advance for your help :) Kind regards, Andy. ------------------------------------------------------------------------ observium mailing list observium@observium.org <mailto:observium@observium.org> http://postman.memetic.org/cgi-bin/mailman/listinfo/observium _______________________________________________ observium mailing list observium@observium.org <mailto:observium@observium.org> http://postman.memetic.org/cgi-bin/mailman/listinfo/observium ------------------------------------------------------------------------ observium mailing list observium@observium.org <mailto:observium@observium.org> http://postman.memetic.org/cgi-bin/mailman/listinfo/observium _______________________________________________ observium mailing list observium@observium.org <mailto:observium@observium.org> http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
Hi Andy,
Tom already answered the oid question.
As for MIBs, people seem to think they are like drivers, some form of pseudocode which programmatically enables data collection.
This isn't the case. A MIB is effectively little more than a number <> name OID translation, with the addition of telling you what data type each OID returns.
"Versions" of MIBs don't change anything in the data path at all, indeed a lot of our modules don't even use the mibs when polling, because they're not really that useful. New versions will either add new OIDs or mark old ones as deprecated (or fix Timmy in engineering g's spelling mistakes).
I've so far only really seen a single issue caused by MIB errors, and several hundred caused by vendor-side SNMP implementations... :D
Adam.
Sent from BlueMail
On 27 May 2016, 11:06, at 11:06, Andy Lemin andy@brandwatch.com wrote:
Hi Adam,
Thanks for your reply.
I'm not sure if it is my email client or something, but I honestly cannot see the OID in your email? ( have expanded every block and I cannot see it ).
This is the entirety of your email; "There's virtually no chance of this bring anything other than net SNMP on openbsd rather helpfully reporting the same ifInDiscards ifOutDiscards counters for all interfaces. What version of net-snmp is it?
Adam.
Sent from BlueMail http://www.bluemail.me/r"
Hence why I asked again? :( Could you please sent it over once more?
If I have got my wires crossed about what MIBs, do you know of a good source to read? I have already done a lot of reading in the past on SNMP, but if I have misunderstood something (which is fine) it just means I need to find a better source of information on the internet to read.
Thanks for your time and help. Cheers, Andy.
On Tue, May 24, 2016 at 7:49 PM, Adam Armstrong adama@memetic.org wrote:
I already gave you the two OIDs in the previous mail.
The existence or not of openbsd specific MIBs are irrelevant in this instance, since its using IF-MIB (also, MIBs don't really do what you
think
they do)
Adam.
Sent from BlueMail http://www.bluemail.me/r
On 24 May 2016, at 18:14, Andy Lemin andy@brandwatch.com wrote:
Yea I figured the same which is why I was after the OID being
called?
Does anyone know? Or know how to find out? Where to look?
OpenBSD actually runs its own SNMPD (not net-snmpd). In the past net-snmpd gave you all the generic stuff, but nothing from the
OpenBSD
enterprise. And SNMPD gave you everything from the OpenBSD
enterprise, but
not the general stuff.
So I have seen people running net-snmpd on the interfaces, and SNMPD
only
on the loopback, then setting up an OID forwarder within net-snmp to forward all OpenBSD enterprise OIDs to the localhost etc. This kinda
worked
but was fragmented and had issues and data holes.. :(
However a year ago or so, SNMPD was significantly extended so that
it now
provides everything net-snmpd does, and so we only run SNMPD. If
SNMPD is
returning the wrong value somewhere, then I can definitely take that
to the
OpenBSD guys.
But before I can I need to know the OID Observium is calling ;)
Also seeing as SNMPD was extended, I think making sure Observium has
the
latest OpenBSD MIB's could be important.
Thanks, Andy.
On Tue, May 24, 2016 at 2:33 PM, Adam Armstrong adama@memetic.org wrote:
There's virtually no chance of this bring anything other than net
SNMP
on openbsd rather helpfully reporting the same ifInDiscards
ifOutDiscards
counters for all interfaces.
What version of net-snmp is it?
Adam.
Sent from BlueMail http://www.bluemail.me/r
On 24 May 2016, at 14:31, Andy Lemin andy@brandwatch.com wrote:
Hi,
We have noticed an interesting problem where on all of our OpenBSD firewalls, every single interface on the same firewall reports the
same
discards rate.
We would like to try and work out which interface these discards
are
actually happening on, so we can work out what the cause is and
check for a
possible remedy (wrong VLANs being trunked through for example).
If they
are bad checksums, than that's ok. But would like to know ;)
Below is a screenshot showing the "Errors" graphs for all ports on
the
same server, notice how they are all displaying the same data.
My thoughts of how to start are; What is the SNMP OID being polled for this information?
I wonder if OpenBSD is incorrectly reporting the same value on all interfaces, or if there is only a single Discards counter/OID for
the whole
system, or if it is an Observium problem etc..
So if anyone can tell me the OID, I can do some more investigation first ;) I don't mind setting up OID mappings in SNMPD etc, if that is
required
I would be happy to provide a configuration template for Observium
and
OpenBSD. And I also wonder how up to date the OpenBSD MIB file built into Observium is?
Thanks in advance for your help :) Kind regards, Andy.
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
Its probably time to add that to the FAQ soon :)
/Markus
2016-05-27 12:33 GMT+02:00 Adam Armstrong adama@memetic.org:
Hi Andy,
Tom already answered the oid question.
As for MIBs, people seem to think they are like drivers, some form of pseudocode which programmatically enables data collection.
This isn't the case. A MIB is effectively little more than a number <> name OID translation, with the addition of telling you what data type each OID returns.
"Versions" of MIBs don't change anything in the data path at all, indeed a lot of our modules don't even use the mibs when polling, because they're not really that useful. New versions will either add new OIDs or mark old ones as deprecated (or fix Timmy in engineering g's spelling mistakes).
I've so far only really seen a single issue caused by MIB errors, and several hundred caused by vendor-side SNMP implementations... :D
Adam.
Sent from BlueMail http://www.bluemail.me/r
On 27 May 2016, at 11:06, Andy Lemin andy@brandwatch.com wrote:
Hi Adam,
Thanks for your reply.
I'm not sure if it is my email client or something, but I honestly cannot see the OID in your email? ( have expanded every block and I cannot see it ).
This is the entirety of your email; "There's virtually no chance of this bring anything other than net SNMP on openbsd rather helpfully reporting the same ifInDiscards ifOutDiscards counters for all interfaces. What version of net-snmp is it?
Adam.
Sent from BlueMail http://www.bluemail.me/r"
Hence why I asked again? :( Could you please sent it over once more?
If I have got my wires crossed about what MIBs, do you know of a good source to read? I have already done a lot of reading in the past on SNMP, but if I have misunderstood something (which is fine) it just means I need to find a better source of information on the internet to read.
Thanks for your time and help. Cheers, Andy.
On Tue, May 24, 2016 at 7:49 PM, Adam Armstrong adama@memetic.org wrote:
I already gave you the two OIDs in the previous mail.
The existence or not of openbsd specific MIBs are irrelevant in this instance, since its using IF-MIB (also, MIBs don't really do what you think they do)
Adam.
Sent from BlueMail http://www.bluemail.me/r
On 24 May 2016, at 18:14, Andy Lemin andy@brandwatch.com wrote:
Yea I figured the same which is why I was after the OID being called?
Does anyone know? Or know how to find out? Where to look?
OpenBSD actually runs its own SNMPD (not net-snmpd). In the past net-snmpd gave you all the generic stuff, but nothing from the OpenBSD enterprise. And SNMPD gave you everything from the OpenBSD enterprise, but not the general stuff.
So I have seen people running net-snmpd on the interfaces, and SNMPD only on the loopback, then setting up an OID forwarder within net-snmp to forward all OpenBSD enterprise OIDs to the localhost etc. This kinda worked but was fragmented and had issues and data holes.. :(
However a year ago or so, SNMPD was significantly extended so that it now provides everything net-snmpd does, and so we only run SNMPD. If SNMPD is returning the wrong value somewhere, then I can definitely take that to the OpenBSD guys.
But before I can I need to know the OID Observium is calling ;)
Also seeing as SNMPD was extended, I think making sure Observium has the latest OpenBSD MIB's could be important.
Thanks, Andy.
On Tue, May 24, 2016 at 2:33 PM, Adam Armstrong adama@memetic.org wrote:
There's virtually no chance of this bring anything other than net SNMP on openbsd rather helpfully reporting the same ifInDiscards ifOutDiscards counters for all interfaces.
What version of net-snmp is it?
Adam.
Sent from BlueMail http://www.bluemail.me/r
On 24 May 2016, at 14:31, Andy Lemin andy@brandwatch.com wrote:
Hi,
We have noticed an interesting problem where on all of our OpenBSD firewalls, every single interface on the same firewall reports the same discards rate.
We would like to try and work out which interface these discards are actually happening on, so we can work out what the cause is and check for a possible remedy (wrong VLANs being trunked through for example). If they are bad checksums, than that's ok. But would like to know ;)
Below is a screenshot showing the "Errors" graphs for all ports on the same server, notice how they are all displaying the same data.
My thoughts of how to start are; What is the SNMP OID being polled for this information?
I wonder if OpenBSD is incorrectly reporting the same value on all interfaces, or if there is only a single Discards counter/OID for the whole system, or if it is an Observium problem etc..
So if anyone can tell me the OID, I can do some more investigation first ;) I don't mind setting up OID mappings in SNMPD etc, if that is required I would be happy to provide a configuration template for Observium and OpenBSD. And I also wonder how up to date the OpenBSD MIB file built into Observium is?
Thanks in advance for your help :) Kind regards, Andy.
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
Ok great.
So it looks like the OID for IF-MIB is .1.3.6.1.2.1.2.2
And yes, I can now confirm that it is an SNMP server problem reporting the same figure for all interfaces as we thought (ifInErrors and IfOutErrors report correctly for each interface, but discards don't). I will get this raised and fixed with OpenBSD now.
Incidentally on Observium, earlier this week we noticed in the Docs that it is not possible to create an Alert Checker, for just Interface Errors, and not Discards. However Errors are not the same as Discards?
Discards are normal every day occurrences in many scenarios both inside the DC and on Internet connections. But Errors are different and should never been seen inside the DC, and so we would like to set an Alert threshold of 10 for IfInErrors, but a threshold of 1000 for IfInDiscards etc.
According to http://www.observium.org/docs/alerting_examples, the variables IfInErrors_rate and IfOutErrors_rate are for both encountered errors and discards.
Would it please be possible to create IfInDiscards_rate and IfOutDiscards_rate so we can Alert on Errors and Discards separately?
Thanks for your help :) Kind regards, Andy.
On Fri, May 27, 2016 at 11:33 AM, Adam Armstrong adama@memetic.org wrote:
Hi Andy,
Tom already answered the oid question.
As for MIBs, people seem to think they are like drivers, some form of pseudocode which programmatically enables data collection.
This isn't the case. A MIB is effectively little more than a number <> name OID translation, with the addition of telling you what data type each OID returns.
"Versions" of MIBs don't change anything in the data path at all, indeed a lot of our modules don't even use the mibs when polling, because they're not really that useful. New versions will either add new OIDs or mark old ones as deprecated (or fix Timmy in engineering g's spelling mistakes).
I've so far only really seen a single issue caused by MIB errors, and several hundred caused by vendor-side SNMP implementations... :D
Adam.
Sent from BlueMail http://www.bluemail.me/r
On 27 May 2016, at 11:06, Andy Lemin andy@brandwatch.com wrote:
Hi Adam,
Thanks for your reply.
I'm not sure if it is my email client or something, but I honestly cannot see the OID in your email? ( have expanded every block and I cannot see it ).
This is the entirety of your email; "There's virtually no chance of this bring anything other than net SNMP on openbsd rather helpfully reporting the same ifInDiscards ifOutDiscards counters for all interfaces. What version of net-snmp is it?
Adam.
Sent from BlueMail http://www.bluemail.me/r"
Hence why I asked again? :( Could you please sent it over once more?
If I have got my wires crossed about what MIBs, do you know of a good source to read? I have already done a lot of reading in the past on SNMP, but if I have misunderstood something (which is fine) it just means I need to find a better source of information on the internet to read.
Thanks for your time and help. Cheers, Andy.
On Tue, May 24, 2016 at 7:49 PM, Adam Armstrong adama@memetic.org wrote:
I already gave you the two OIDs in the previous mail.
The existence or not of openbsd specific MIBs are irrelevant in this instance, since its using IF-MIB (also, MIBs don't really do what you think they do)
Adam.
Sent from BlueMail http://www.bluemail.me/r
On 24 May 2016, at 18:14, Andy Lemin andy@brandwatch.com wrote:
Yea I figured the same which is why I was after the OID being called?
Does anyone know? Or know how to find out? Where to look?
OpenBSD actually runs its own SNMPD (not net-snmpd). In the past net-snmpd gave you all the generic stuff, but nothing from the OpenBSD enterprise. And SNMPD gave you everything from the OpenBSD enterprise, but not the general stuff.
So I have seen people running net-snmpd on the interfaces, and SNMPD only on the loopback, then setting up an OID forwarder within net-snmp to forward all OpenBSD enterprise OIDs to the localhost etc. This kinda worked but was fragmented and had issues and data holes.. :(
However a year ago or so, SNMPD was significantly extended so that it now provides everything net-snmpd does, and so we only run SNMPD. If SNMPD is returning the wrong value somewhere, then I can definitely take that to the OpenBSD guys.
But before I can I need to know the OID Observium is calling ;)
Also seeing as SNMPD was extended, I think making sure Observium has the latest OpenBSD MIB's could be important.
Thanks, Andy.
On Tue, May 24, 2016 at 2:33 PM, Adam Armstrong adama@memetic.org wrote:
There's virtually no chance of this bring anything other than net SNMP on openbsd rather helpfully reporting the same ifInDiscards ifOutDiscards counters for all interfaces.
What version of net-snmp is it?
Adam.
Sent from BlueMail http://www.bluemail.me/r
On 24 May 2016, at 14:31, Andy Lemin andy@brandwatch.com wrote:
Hi,
We have noticed an interesting problem where on all of our OpenBSD firewalls, every single interface on the same firewall reports the same discards rate.
We would like to try and work out which interface these discards are actually happening on, so we can work out what the cause is and check for a possible remedy (wrong VLANs being trunked through for example). If they are bad checksums, than that's ok. But would like to know ;)
Below is a screenshot showing the "Errors" graphs for all ports on the same server, notice how they are all displaying the same data.
My thoughts of how to start are; What is the SNMP OID being polled for this information?
I wonder if OpenBSD is incorrectly reporting the same value on all interfaces, or if there is only a single Discards counter/OID for the whole system, or if it is an Observium problem etc..
So if anyone can tell me the OID, I can do some more investigation first ;) I don't mind setting up OID mappings in SNMPD etc, if that is required I would be happy to provide a configuration template for Observium and OpenBSD. And I also wonder how up to date the OpenBSD MIB file built into Observium is?
Thanks in advance for your help :) Kind regards, Andy.
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
participants (4)
-
Adam Armstrong -
Andy Lemin -
Markus Klock -
Tom Laermans