Gigbit Interface Alerts! Why?

[mikea730]

mikea730 [http://community.zenoss.org/people/mikea730] created the discussion

"Gigbit Interface Alerts! Why?"

To view the discussion, visit: http://community.zenoss.org/message/62102#62102

--------------------------------------------------------------
Running Zenoss 3.2.0 on SUSE 11

I'm seeing what appear to be false alerts on several "/Networt/Switch" Interfaces that I can't explain.  Seems like this has always happened and I wanted to see if anyone else has experienced this and find out why this happens.

For example,  I got the following alert this morning. 

I have a device that has a Gigabit interface card (one of many interface cards in the device) that alerts when the inbound level spikes significantly compared to it's average traffic, but is still "way" below what should be the threshold.  I really want to get to the bottom of this since the network group keeps asking me about this!!  Here are the details of the device.
Type:
   ethernetCsmacd_64
Speed:
   1000000000
Duplex Mode:
   fullDuplex
MTU:
   1500
Here is the details of the template assigned to that device:

"/ethernetCsmacd_64/Devices - Template for 64-bit interface counters. Must use SNMP v2c for it to work."
  Threshold - "High Utilzation"
         Maximum Value:   (here.speed or 1e9) / 8 * .95

This threshold was triggered and an alert was sent showing the following:
    "threshold of high utilization exceeded: current value 4308123.81"

If I do the math, 1,000,000,000 / 8 * .95 = 118,750,000 (threshold value)

4308123.81 * 8 / .95 = 36,278,937.35 (value that caused the alert, NOTE: the graph reflects this value as well at the time of this alert)

I don't understand why this alerted with a value of 4308123.81 (or 36,278,937.35)

Am I doing the math incorrectly?

This is not limited to just this device, it happens on many of our network switches.

Thanks!!


--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/62102#62102]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[mikea730]

mikea730 [http://community.zenoss.org/people/mikea730] created the discussion

"Re: Gigbit Interface Alerts! Why?"

To view the discussion, visit: http://community.zenoss.org/message/62540#62540

--------------------------------------------------------------
anyone?
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/62540#62540]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[Mike McDonough]

Mike McDonough [http://community.zenoss.org/people/mikemcdonough] created the discussion

"Re: Gigbit Interface Alerts! Why?"

To view the discussion, visit: http://community.zenoss.org/message/62571#62571

--------------------------------------------------------------
I've had to add a transform to Events >Perf > Interface to resolve an issue where interfaces were not reporting the correct speed. I also needed to drop any interface in Xen device class or any virtual interface.

I found a script that I started from somewhere here in one of these forums thought I can't quite remember the DOC number

http://localhost:8080/zport/dmd/Events/Perf/Interface/editEventClassTransform http://localhost:8080/zport/dmd/Events/Perf/Interface/editEventClassTransform

import re
match = re.search('threshold of [^:]+: current value ([\d\.]+)', evt.message)
if match and device:
    ifaces = [ i for i in device.os.interfaces() if i.name() == evt.component ]
    if ( re.search("vif", evt.component[:5]) or re.search("Xen", evt.DeviceClass[8:11])):
         evt._action = 'drop'
    else:
        if len(ifaces) > 0:
            currentusage = float(match.groups()[0]) * 8
            evtKey = evt.eventKey


            if evtKey == "ifInOctets_ifInOctets|high utilization":
                NewKey = "Input"
            elif evtKey == "ifHCInOctets_ifHCInOctets|high utilization":
                NewKey = "Input"
            elif evtKey == "ifOutOctets_ifOutOctets|high utilization":
                NewKey = "Output"
            elif evtKey == "ifHCOutOctets_ifHCOutOctets|high utilization":
                NewKey = "Output"


            speed = ifaces[0].speed
            if speed > 0:
                util = (currentusage / speed) * 100
            else:
                util = 0


            if currentusage > 1000000000:
                 Usage = currentusage / 1000000000
                 evt.summary = "High " + NewKey + " Utilization: Currently (%3.2f Gbps) is being used. util = %5d%%" %  (Usage, util)
            elif currentusage > 1000000:
                Usage = currentusage / 1000000
                evt.summary = "High " + NewKey + " Utilization: Currently (%3.2f Mbps) is being used. util = %5d%%" %  (Usage, util)
            elif currentusage > 1000:
                Usage = currentusage / 1000
                evt.summary = "High " + NewKey + " Utilization: Currently (%3.2f Kbps) is being used. util = %5d%%" %  (Usage, util)
            elif currentusage < 1000:
                Usage = currentusage
                evt.summary = "High " + NewKey + " Utilization: Currently (%3.2f bps) is being used. util = %5d%%" %  (Usage, util)
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/62571#62571]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]