Port Properties Alert Question and Odd Behavior
Is there a way to see all Ports that have been disabled for altering?
I enabled email alerts in config.php for port percentage, but seeing some odd behavior with the percentage portion with the physical interfaces inside a etherchannel interface. Below are a couple emails I received. The bandwidth mentioned in the email is more than the physical interface. Is there another option I need to turn on or off to account for this behavior? Any suggestions are appreciated.
This physical interface didn't go over 444M. The port channel have 8 physical link in it.
Port saturation threshold alarm: cisco.switch.com on GigabitEthernet3/1 Rates:1.63Gbps/11.6kbps(163/0) >85% of 1Gbps
Another email
This physical interface hit a 1G. The port channel has 2 physical links in it.
Port saturation threshold alarm: cisco.switch.com on GigabitEthernet2/25 Rates:147Mbps/6.62Gbps(15/662) >85% of 1Gbps
added to config.php
$config['alerts']['port_util_alert'] = TRUE; $config['alerts']['port_util_perc'] = 85;
Thanks, Chip
That's the old alerting stuff, use the new stuff, it's less broken!
I recognise your name, so I'm pretty sure you're a subscriber :)
adam.
On 2014-01-20 10:42, Chip Pleasants wrote:
Is there a way to see all Ports that have been disabled for altering?
I enabled email alerts in config.php for port percentage, but seeing some odd behavior with the percentage portion with the physical interfaces inside a etherchannel interface. Below are a couple emails I received. The bandwidth mentioned in the email is more than the physical interface. Is there another option I need to turn on or off to account for this behavior? Any suggestions are appreciated.
This physical interface didn't go over 444M. The port channel have 8 physical link in it.
Port saturation threshold alarm: cisco.switch.com [1] on GigabitEthernet3/1 Rates:1.63Gbps/11.6kbps(163/0) >85% of 1Gbps
Another email
This physical interface hit a 1G. The port channel has 2 physical links in it.
Port saturation threshold alarm: cisco.switch.com [1] on GigabitEthernet2/25 Rates:147Mbps/6.62Gbps(15/662) >85% of 1Gbps
added to config.php
$config['alerts']['port_util_alert'] = TRUE; $config['alerts']['port_util_perc'] = 85;
Thanks, Chip
Links:
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
Ah. Sorry. Creating ones in the new system now.
-Chip
On Mon, Jan 20, 2014 at 12:32 PM, Adam Armstrong adama@memetic.org wrote:
That's the old alerting stuff, use the new stuff, it's less broken!
I recognise your name, so I'm pretty sure you're a subscriber :)
adam.
On 2014-01-20 10:42, Chip Pleasants wrote:
Is there a way to see all Ports that have been disabled for altering?
I enabled email alerts in config.php for port percentage, but seeing some odd behavior with the percentage portion with the physical interfaces inside a etherchannel interface. Below are a couple emails I received. The bandwidth mentioned in the email is more than the physical interface. Is there another option I need to turn on or off to account for this behavior? Any suggestions are appreciated.
This physical interface didn't go over 444M. The port channel have 8 physical link in it.
Port saturation threshold alarm: cisco.switch.com [1] on GigabitEthernet3/1
Rates:1.63Gbps/11.6kbps(163/0) >85% of 1Gbps
Another email
This physical interface hit a 1G. The port channel has 2 physical links in it.
Port saturation threshold alarm: cisco.switch.com [1] on GigabitEthernet2/25
Rates:147Mbps/6.62Gbps(15/662) >85% of 1Gbps
added to config.php
$config['alerts']['port_util_alert'] = TRUE; $config['alerts']['port_util_perc'] = 85;
Thanks, Chip
Links:
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
It does seem that perhaps there is a 32/64bit counter issue, too, as the numerical values passed to the new and old alerting code are generated at the same points.
Are the values in the HTML tables showing correct values?
adam.
On 2014-01-20 15:53, Chip Pleasants wrote:
Ah. Sorry. Creating ones in the new system now.
-Chip
On Mon, Jan 20, 2014 at 12:32 PM, Adam Armstrong adama@memetic.org wrote:
That's the old alerting stuff, use the new stuff, it's less broken!
I recognise your name, so I'm pretty sure you're a subscriber :)
adam.
On 2014-01-20 10:42, Chip Pleasants wrote:
Is there a way to see all Ports that have been disabled for altering?
I enabled email alerts in config.php for port percentage, but seeing some odd behavior with the percentage portion with the physical interfaces inside a etherchannel interface. Below are a couple emails I received. The bandwidth mentioned in the email is more than the physical interface. Is there another option I need to turn on or off to account for this behavior? Any suggestions are appreciated.
This physical interface didn't go over 444M. The port channel have 8 physical link in it.
Port saturation threshold alarm: cisco.switch.com [1] [1] on GigabitEthernet3/1
Rates:1.63Gbps/11.6kbps(163/0) >85% of 1Gbps
Another email
This physical interface hit a 1G. The port channel has 2 physical links in it.
Port saturation threshold alarm: cisco.switch.com [1] [1] on GigabitEthernet2/25
Rates:147Mbps/6.62Gbps(15/662) >85% of 1Gbps
added to config.php
$config['alerts']['port_util_alert'] = TRUE; $config['alerts']['port_util_perc'] = 85;
Thanks, Chip
Links:
[1] http://cisco.switch.com [1]
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium [2] _______________________________________________ observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium [2]
Links:
[1] http://cisco.switch.com [2] http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
By HTMP tables, Do you mean, does the usage being reported corresponded to the physical/logical interface usage? We have other tools doing the same job which I can compare against. I'll take a look around. 'll also take a look on the interface when the high usage is occurring.
-Chip
On Mon, Jan 20, 2014 at 5:15 PM, Adam Armstrong adama@memetic.org wrote:
It does seem that perhaps there is a 32/64bit counter issue, too, as the numerical values passed to the new and old alerting code are generated at the same points.
Are the values in the HTML tables showing correct values?
adam.
On 2014-01-20 15:53, Chip Pleasants wrote:
Ah. Sorry. Creating ones in the new system now.
-Chip
On Mon, Jan 20, 2014 at 12:32 PM, Adam Armstrong adama@memetic.org wrote:
That's the old alerting stuff, use the new stuff, it's less broken!
I recognise your name, so I'm pretty sure you're a subscriber :)
adam.
On 2014-01-20 10:42, Chip Pleasants wrote:
Is there a way to see all Ports that have been disabled for altering?
I enabled email alerts in config.php for port percentage, but seeing some odd behavior with the percentage portion with the physical interfaces inside a etherchannel interface. Below are a couple emails I received. The bandwidth mentioned in the email is more than the physical interface. Is there another option I need to turn on or off to account for this behavior? Any suggestions are appreciated.
This physical interface didn't go over 444M. The port channel have 8 physical link in it.
Port saturation threshold alarm: cisco.switch.com [1] [1] on GigabitEthernet3/1
Rates:1.63Gbps/11.6kbps(163/0) >85% of 1Gbps
Another email
This physical interface hit a 1G. The port channel has 2 physical links in it.
Port saturation threshold alarm: cisco.switch.com [1] [1] on GigabitEthernet2/25
Rates:147Mbps/6.62Gbps(15/662) >85% of 1Gbps
added to config.php
$config['alerts']['port_util_alert'] = TRUE; $config['alerts']['port_util_perc'] = 85;
Thanks, Chip
Links:
[1] http://cisco.switch.com [1]
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium [2]
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium [2]
Links:
[1] http://cisco.switch.com [2] http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
In device -> ports, the table has bps/pps values. Also, are the graphs ok?
adam.
On 2014-01-20 16:31, Chip Pleasants wrote:
By HTMP tables, Do you mean, does the usage being reported corresponded to the physical/logical interface usage? We have other tools doing the same job which I can compare against. I'll take a look around. 'll also take a look on the interface when the high usage is occurring.
-Chip
On Mon, Jan 20, 2014 at 5:15 PM, Adam Armstrong adama@memetic.org wrote:
It does seem that perhaps there is a 32/64bit counter issue, too, as the numerical values passed to the new and old alerting code are generated at the same points.
Are the values in the HTML tables showing correct values?
adam.
On 2014-01-20 15:53, Chip Pleasants wrote:
Ah. Sorry. Creating ones in the new system now.
-Chip
On Mon, Jan 20, 2014 at 12:32 PM, Adam Armstrong adama@memetic.org wrote:
That's the old alerting stuff, use the new stuff, it's less broken!
I recognise your name, so I'm pretty sure you're a subscriber :)
adam.
On 2014-01-20 10:42, Chip Pleasants wrote:
Is there a way to see all Ports that have been disabled for altering?
I enabled email alerts in config.php for port percentage, but seeing some odd behavior with the percentage portion with the physical interfaces inside a etherchannel interface. Below are a couple emails I received. The bandwidth mentioned in the email is more than the physical interface. Is there another option I need to turn on or off to account for this behavior? Any suggestions are appreciated.
This physical interface didn't go over 444M. The port channel have 8 physical link in it.
Port saturation threshold alarm: cisco.switch.com [1] [1] [1] on GigabitEthernet3/1
Rates:1.63Gbps/11.6kbps(163/0) >85% of 1Gbps
Another email
This physical interface hit a 1G. The port channel has 2 physical links in it.
Port saturation threshold alarm: cisco.switch.com [1] [1] [1] on GigabitEthernet2/25
Rates:147Mbps/6.62Gbps(15/662) >85% of 1Gbps
added to config.php
$config['alerts']['port_util_alert'] = TRUE; $config['alerts']['port_util_perc'] = 85;
Thanks, Chip
Links:
[1] http://cisco.switch.com [1] [1]
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium [2] [2]
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium [2] [2]
Links:
[1] http://cisco.switch.com [1] [2] http://postman.memetic.org/cgi-bin/mailman/listinfo/observium [2]
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium [2]
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium [2]
Links:
[1] http://cisco.switch.com [2] http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
The graphs look good. The bps/pps graphs mirror each other. I created a Port alert for ifInOctets_perc/ifOutOctets_perc with a 20 min wait for all my cisco devices a couple hours ago.
Thanks! -Chip
On Mon, Jan 20, 2014 at 5:33 PM, Adam Armstrong adama@memetic.org wrote:
In device -> ports, the table has bps/pps values. Also, are the graphs ok?
adam.
On 2014-01-20 16:31, Chip Pleasants wrote:
By HTMP tables, Do you mean, does the usage being reported corresponded to the physical/logical interface usage? We have other tools doing the same job which I can compare against. I'll take a look around. 'll also take a look on the interface when the high usage is occurring.
-Chip
On Mon, Jan 20, 2014 at 5:15 PM, Adam Armstrong adama@memetic.org wrote:
It does seem that perhaps there is a 32/64bit counter issue, too, as the numerical values passed to the new and old alerting code are generated at the same points.
Are the values in the HTML tables showing correct values?
adam.
On 2014-01-20 15:53, Chip Pleasants wrote:
Ah. Sorry. Creating ones in the new system now.
-Chip
On Mon, Jan 20, 2014 at 12:32 PM, Adam Armstrong adama@memetic.org wrote:
That's the old alerting stuff, use the new stuff, it's less broken!
I recognise your name, so I'm pretty sure you're a subscriber :)
adam.
On 2014-01-20 10:42, Chip Pleasants wrote:
Is there a way to see all Ports that have been disabled for altering?
I enabled email alerts in config.php for port percentage, but seeing some odd behavior with the percentage portion with the physical interfaces inside a etherchannel interface. Below are a couple emails I received. The bandwidth mentioned in the email is more than the physical interface. Is there another option I need to turn on or off to account for this behavior? Any suggestions are appreciated.
This physical interface didn't go over 444M. The port channel have 8 physical link in it.
Port saturation threshold alarm: cisco.switch.com [1] [1] [1] on GigabitEthernet3/1
Rates:1.63Gbps/11.6kbps(163/0) >85% of 1Gbps
Another email
This physical interface hit a 1G. The port channel has 2 physical links in it.
Port saturation threshold alarm: cisco.switch.com [1] [1] [1] on GigabitEthernet2/25
Rates:147Mbps/6.62Gbps(15/662) >85% of 1Gbps
added to config.php
$config['alerts']['port_util_alert'] = TRUE; $config['alerts']['port_util_perc'] = 85;
Thanks, Chip
Links:
[1] http://cisco.switch.com [1] [1]
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium [2] [2]
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium [2] [2]
Links:
[1] http://cisco.switch.com [1] [2] http://postman.memetic.org/cgi-bin/mailman/listinfo/observium [2]
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium [2]
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium [2]
Links:
[1] http://cisco.switch.com [2] http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
On 2014-01-20 16:50, Chip Pleasants wrote:
The graphs look good. The bps/pps graphs mirror each other. I created a Port alert for ifInOctets_perc/ifOutOctets_perc with a 20 min wait for all my cisco devices a couple hours ago.
The delay helps at filtering out spikes and false positives a lot!
I don't think you can change it after alert creation, though. I need to fix that!
adam.
I think i'm running into the original behavior. Graphs looks the same for bps/pps. The port-channel interface has 4 Gig links in it. The physical links and the port channel dont seem to reflect the email usage rates. Anything else I can grab?
Thanks, Chip
Port saturation threshold alarm: cisco.switch.net on GigabitEthernet9/8
Rates:1.6Gbps/5.94Gbps(160/594) >85% of 1Gbps
switch#sh int g9/8
GigabitEthernet9/8 is up, line protocol is up (connected)
Hardware is C6k 1000Mb 802.3, address is 0021.a082.1bd5 (bia 0021.a082.1bd5)
MTU 1500 bytes, BW 1000000 Kbit, DLY 10 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive set (10 sec)
Full-duplex, 1000Mb/s
input flow-control is off, output flow-control is off
Clock mode is auto
ARP type: ARPA, ARP Timeout 04:00:00
Last input never, output 3y47w, output hang never
Last clearing of "show interface" counters never
Input queue: 0/2000/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo
Output queue: 0/40 (size/max)
5 minute input rate 33000 bits/sec, 29 packets/sec
5 minute output rate 10000 bits/sec, 10 packets/sec
473713393 packets input, 43716255496 bytes, 0 no buffer
Received 3 broadcasts (0 multicasts)
0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 watchdog, 0 multicast, 0 pause input
0 input packets with dribble condition detected
1489063314 packets output, 161946605971 bytes, 0 underruns
0 output errors, 0 collisions, 3 interface resets
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier, 0 PAUSE output
0 output buffer failures, 0 output buffers swapped out
switch#sh run int g9/8
Building configuration...
Current configuration : 345 bytes
!
interface GigabitEthernet9/8
switchport
switchport trunk encapsulation dot1q
switchport trunk native vlan 21
switchport trunk allowed vlan 21,54,900-999
switchport mode trunk
no ip address
no logging event link-status
no snmp trap link-status
mls qos trust dscp
no cdp enable
channel-group 92 mode on
end
switch#sh int port-channel 92
Port-channel92 is up, line protocol is up (connected)
Hardware is EtherChannel, address is 0021.a082.1bd5 (bia 0021.a082.1bd5)
MTU 1500 bytes, BW 4000000 Kbit, DLY 10 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive set (10 sec)
Full-duplex, 1000Mb/s
input flow-control is off, output flow-control is off
Members in this channel: Gi9/5 Gi9/6 Gi9/7 Gi9/8
ARP type: ARPA, ARP Timeout 04:00:00
Last input never, output never, output hang never
Last clearing of "show interface" counters never
Input queue: 0/2000/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo
Output queue: 0/40 (size/max)
switch#sh int g9/7
GigabitEthernet9/7 is up, line protocol is up (connected)
Hardware is C6k 1000Mb 802.3, address is 0021.a082.1bd4 (bia 0021.a082.1bd4)
Description: WiSM WLC W06
MTU 1500 bytes, BW 1000000 Kbit, DLY 10 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive set (10 sec)
Full-duplex, 1000Mb/s
input flow-control is off, output flow-control is off
Clock mode is auto
ARP type: ARPA, ARP Timeout 04:00:00
Last input never, output 3y47w, output hang never
Last clearing of "show interface" counters never
Input queue: 0/2000/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo
Output queue: 0/40 (size/max)
5 minute input rate 43000 bits/sec, 26 packets/sec
5 minute output rate 25000 bits/sec, 14 packets/sec
575824416 packets input, 103856301413 bytes, 0 no buffer
Received 39987948 broadcasts (0 multicasts)
0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 watchdog, 0 multicast, 0 pause input
0 input packets with dribble condition detected
1091712210 packets output, 132237718830 bytes, 0 underruns
0 output errors, 0 collisions, 3 interface resets
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier, 0 PAUSE output
0 output buffer failures, 0 output buffers swapped out
switch#sh int g9/6
GigabitEthernet9/6 is up, line protocol is up (connected)
Hardware is C6k 1000Mb 802.3, address is 0021.a082.1bd3 (bia 0021.a082.1bd3)
Description: WiSM WLC W06
MTU 1500 bytes, BW 1000000 Kbit, DLY 10 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive set (10 sec)
Full-duplex, 1000Mb/s
input flow-control is off, output flow-control is off
Clock mode is auto
ARP type: ARPA, ARP Timeout 04:00:00
Last input never, output 3y47w, output hang never
Last clearing of "show interface" counters never
Input queue: 0/2000/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo
Output queue: 0/40 (size/max)
5 minute input rate 35000 bits/sec, 32 packets/sec
5 minute output rate 17000 bits/sec, 17 packets/sec
455573656 packets input, 45036750706 bytes, 0 no buffer
Received 13735 broadcasts (13730 multicasts)
0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 watchdog, 0 multicast, 0 pause input
0 input packets with dribble condition detected
4443952461 packets output, 465654922995 bytes, 0 underruns
0 output errors, 0 collisions, 3 interface resets
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier, 0 PAUSE output
0 output buffer failures, 0 output buffers swapped out
switch#sh int g9/5
GigabitEthernet9/5 is up, line protocol is up (connected)
Hardware is C6k 1000Mb 802.3, address is 0021.a082.1bd2 (bia 0021.a082.1bd2)
Description: WiSM WLC W05
MTU 1500 bytes, BW 1000000 Kbit, DLY 10 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive set (10 sec)
Full-duplex, 1000Mb/s
input flow-control is off, output flow-control is off
Clock mode is auto
ARP type: ARPA, ARP Timeout 04:00:00
Last input never, output 3y47w, output hang never
Last clearing of "show interface" counters never
Input queue: 0/2000/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo
Output queue: 0/40 (size/max)
5 minute input rate 30000 bits/sec, 27 packets/sec
5 minute output rate 21000 bits/sec, 26 packets/sec
403436684 packets input, 40480753309 bytes, 0 no buffer
Received 1 broadcasts (0 multicasts)
0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 watchdog, 0 multicast, 0 pause input
0 input packets with dribble condition detected
2796049316 packets output, 230244339432 bytes, 0 underruns
0 output errors, 0 collisions, 3 interface resets
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier, 0 PAUSE output
0 output buffer failures, 0 output buffers swapped out
switch#
5 minute input rate 152000 bits/sec, 118 packets/sec
5 minute output rate 67000 bits/sec, 63 packets/sec
1968280446 packets input, 240101899166 bytes, 0 no buffer
Received 41602472 broadcasts (13976 multicasts)
0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 watchdog, 0 multicast, 0 pause input
0 input packets with dribble condition detected
10094487685 packets output, 1015850895073 bytes, 0 underruns
0 output errors, 0 collisions, 2 interface resets
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier, 0 PAUSE output
0 output buffer failures, 0 output buffers swapped out
switch#
On Mon, Jan 20, 2014 at 5:59 PM, Adam Armstrong adama@memetic.org wrote:
On 2014-01-20 16:50, Chip Pleasants wrote:
The graphs look good. The bps/pps graphs mirror each other. I created a Port alert for ifInOctets_perc/ifOutOctets_perc with a 20 min wait for all my cisco devices a couple hours ago.
The delay helps at filtering out spikes and false positives a lot!
I don't think you can change it after alert creation, though. I need to fix that!
adam.
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
participants (2)
-
Adam Armstrong -
Chip Pleasants