Juniper SRX1500 firewall questionable CPU OIDs used
Hello,
I have Juniper SRX1500 firewalls for which Observium is sending false positive CPU alerts (example included below) based on feedback from Juniper. More specifically, I was told that the OIDs used by Observium to collect CPU information are not the correct ones for this devices in particular. Here are the OIDs that I was told should be used to monitor the data plane CPU usage (instead of the standard OIDs that poll the kernel):.1.3.6.1.4.1.2636.3.39.1.12.1.1.1 Or more specifically for forwarding plane flow (SPU) only: .1.3.6.1.4.1.2636.3.39.1.12.1.1.1.3" Here is an Observium alert example:
Alert
Juniper Firewall CPU Usage is over 40%!
Entity
FPC: FEB @0/*/*
Conditions
processor_usage gt 40 (49)
Metrics
processor_usage = 49
Duration
4m 19s (2017-10-22 17:22:53)
Device
Device
host.mine
Hardware
SRX1500
Operating System
Juniper JunOS 15.1X49-D50.3 Internet Router
Location
lab
Uptime
27 days, 12h 3m 4s
The above alert is seen several times a day per device. I'm currently running version 17.10.8921 (Linux 2.6.32-642.13.1.el6.x86_64 [amd64]) but have seen this with different frequencies on all other versions I had. Appreciate any information on potential fix or workaround or feedback on the Juniper response. Thanks,Al.
Hi,
We already discover and poll these processors correctly. If you don't want alerts for specific types of processor, filter them in your alert checker config.
Observium is only generating alerts for the things you have told it to generate alerts for.
For example :
+------------------------+-------+---------+-------+ | Label | Type | Index | Usage | +------------------------+-------+---------+-------+ | node0 FPC: FPC @ 0/*/* | junos | 7.1.0.0 | 0% | | node0 FPC: FPC @ 2/*/* | junos | 7.3.0.0 | 0% | | node0 Routing Engine | junos | 9.1.0.0 | 34% | | node0 SPC slot 0 | junos | 0 | 0% | | node1 SPC slot 0 | junos | 18 | 0% | +------------------------+-------+---------+-------+
The first 3 are jnxOperatingCPU:
jnxOperatingDRAMSize.7.1.0.0 = 0 jnxOperatingDRAMSize.7.3.0.0 = 0 jnxOperatingDRAMSize.9.1.0.0 = 0 jnxOperatingDescr.7.1.0.0 = node0 FPC: FPC @ 0/*/* jnxOperatingDescr.7.3.0.0 = node0 FPC: FPC @ 2/*/* jnxOperatingDescr.9.1.0.0 = node0 Routing Engine
The final 2 are jnxJsSPUMonitoringCPUUsage (the OID you give above):
jnxJsSPUMonitoringNodeDescr.0 = node0 jnxJsSPUMonitoringNodeDescr.18 = node1 jnxJsSPUMonitoringCPUUsage.0 = 0 jnxJsSPUMonitoringCPUUsage.18 = 0
Unfortunately for legacy reasons they have the same type of "junos", which may make it slightly more complex to filter them.
adam. On 2017-10-23 15:12:08, aas029 aas029@yahoo.com wrote:
Hello,
I have Juniper SRX1500 firewalls for which Observium is sending false positive CPU alerts (example included below) based on feedback from Juniper.
More specifically, I was told that the OIDs used by Observium to collect CPU information are not the correct ones for this devices in particular. Here are the OIDs that I was told should be used to monitor the data plane CPU usage (instead of the standard OIDs that poll the kernel): .1.3.6.1.4.1.2636.3.39.1.12.1.1.1 Or more specifically for forwarding plane flow (SPU) only:
.1.3.6.1.4.1.2636.3.39.1.12.1.1.1.3"
Here is an Observium alert example:
Alert Juniper Firewall CPU Usage is over 40%! Entity FPC: FEB @0/*/* Conditions processor_usage gt 40 (49) Metrics processor_usage = 49 Duration 4m 19s (2017-10-22 17:22:53) Device Device host.mine Hardware SRX1500 Operating System Juniper JunOS 15.1X49-D50.3 Internet Router Location lab Uptime 27 days, 12h 3m 4s
The above alert is seen several times a day per device. I'm currently running version 17.10.8921 (Linux 2.6.32-642.13.1.el6.x86_64 [amd64]) but have seen this with different frequencies on all other versions I had.
Appreciate any information on potential fix or workaround or feedback on the Juniper response.
Thanks, Al.
Hello Adam,
Thank you very much for the quick response. I have a minor thing to confirm please just to besure.
There are 3 cpu related charts in Observium for SRX1500 (in standalone configuration). Can you please confirm that the chart which is described inObservium as "SPC slot 0" is the one that corresponds toOID .1.3.6.1.4.1.2636.3.39.1.12.1.1.1.3?
For reference:
user@fw00> show snmp mib get.1.3.6.1.4.1.2636.3.39.1.12.1.1.1.4.0
jnxJsSPUMonitoringCPUUsage.0 = 0
Thank you again,
Al.
From: Adam Armstrong adama@observium.org To: observium@observium.org Sent: Tuesday, October 24, 2017 5:24 AM Subject: Re: [Observium] Juniper SRX1500 firewall questionable CPU OIDs used
Hi, We already discover and poll these processors correctly. If you don't want alerts for specific types of processor, filter them in your alert checker config. Observium is only generating alerts for the things you have told it to generate alerts for. For example : +------------------------+-------+---------+-------+| Label | Type | Index | Usage |+------------------------+-------+---------+-------+| node0 FPC: FPC @ 0/*/* | junos | 7.1.0.0 | 0% || node0 FPC: FPC @ 2/*/* | junos | 7.3.0.0 | 0% || node0 Routing Engine | junos | 9.1.0.0 | 34% || node0 SPC slot 0 | junos | 0 | 0% || node1 SPC slot 0 | junos | 18 | 0% |+------------------------+-------+---------+-------+ The first 3 are jnxOperatingCPU: jnxOperatingDRAMSize.7.1.0.0 = 0jnxOperatingDRAMSize.7.3.0.0 = 0jnxOperatingDRAMSize.9.1.0.0 = 0jnxOperatingDescr.7.1.0.0 = node0 FPC: FPC @ 0/*/*jnxOperatingDescr.7.3.0.0 = node0 FPC: FPC @ 2/*/*jnxOperatingDescr.9.1.0.0 = node0 Routing Engine The final 2 are jnxJsSPUMonitoringCPUUsage (the OID you give above): jnxJsSPUMonitoringNodeDescr.0 = node0jnxJsSPUMonitoringNodeDescr.18 = node1jnxJsSPUMonitoringCPUUsage.0 = 0jnxJsSPUMonitoringCPUUsage.18 = 0 Unfortunately for legacy reasons they have the same type of "junos", which may make it slightly more complex to filter them. adam. On 2017-10-23 15:12:08, aas029 aas029@yahoo.com wrote: Hello,
I have Juniper SRX1500 firewalls for which Observium is sending false positive CPU alerts (example included below) based on feedback from Juniper. More specifically, I was told that the OIDs used by Observium to collect CPU information are not the correct ones for this devices in particular. Here are the OIDs that I was told should be used to monitor the data plane CPU usage (instead of the standard OIDs that poll the kernel):.1.3.6.1.4.1.2636.3.39.1.12.1.1.1 Or more specifically for forwarding plane flow (SPU) only: .1.3.6.1.4.1.2636.3.39.1.12.1.1.1.3" Here is an Observium alert example:
| Alert | Juniper Firewall CPU Usage is over 40%! | | Entity | FPC: FEB @0/*/* | | Conditions | processor_usage gt 40 (49) | | Metrics | processor_usage = 49 | | Duration | 4m 19s (2017-10-22 17:22:53) | | Device | | Device | host.mine | | Hardware | SRX1500 | | Operating System | Juniper JunOS 15.1X49-D50.3 Internet Router | | Location | lab | | Uptime | 27 days, 12h 3m 4s |
The above alert is seen several times a day per device. I'm currently running version 17.10.8921 (Linux 2.6.32-642.13.1.el6.x86_64 [amd64]) but have seen this with different frequencies on all other versions I had. Appreciate any information on potential fix or workaround or feedback on the Juniper response. Thanks,Al.
_______________________________________________ observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
participants (3)
-
aas029 -
Adam Armstrong -
Al