NBAR query problem

khutton · Post by **khutton** » Tue Jan 13, 2004 3:34 pm

Having some trouble getting the NBAR query to work properly. First, I can go to my Cisco 2620 and I get meaningful output from

show ip nbar protocol-discovery

Listing the standard protocols on Fastethernet0/0. The problem is that I am not getting anything from the query in cacti. I have followed the instructions provided at www.eatworms.org.uk. Here is the verbose query output:

+ Running data query [10].
+ Found type = '4 '[script query].
+ Found data query XML file at '/usr/local/www/htdocs/cacti/resource/script_queries/cisco_nbar_all.xml'
+ XML file parsed ok.
+ Executing script for list of indexes '/usr/local/www/php/bin/php -q /usr/local/www/htdocs/cacti/scripts/query_cisco_nbar_all.php rtr001.yeo.org community 1 index'
+ Executing script query '/usr/local/www/php/bin/php -q /usr/local/www/htdocs/cacti/scripts/query_cisco_nbar_all.php rtr001.yeo.org community 1 query index'
+ Executing script query '/usr/local/www/php/bin/php -q /usr/local/www/htdocs/cacti/scripts/query_cisco_nbar_all.php rtr001.yeo.org community 1 query ifName'
+ Executing script query '/usr/local/www/php/bin/php -q /usr/local/www/htdocs/cacti/scripts/query_cisco_nbar_all.php rtr001.yeo.org community 1 query ifType'
+ Executing script query '/usr/local/www/php/bin/php -q /usr/local/www/htdocs/cacti/scripts/query_cisco_nbar_all.php rtr001.yeo.org community 1 query ifAdminStatus'
+ Executing script query '/usr/local/www/php/bin/php -q /usr/local/www/htdocs/cacti/scripts/query_cisco_nbar_all.php rtr001.yeo.org community 1 query ifOperStatus'
+ Executing script query '/usr/local/www/php/bin/php -q /usr/local/www/htdocs/cacti/scripts/query_cisco_nbar_all.php rtr001.yeo.org community 1 query protoname'

There is no data returned [0 Items, 0 rows]

The community has been changed to protect the innocent. Any one have an idea what I have done wrong?

khutton · Post by **khutton** » Wed Jan 14, 2004 9:02 am

I have continued to search the message board for a solution but haven't found it. It seems that at least one other has posted this same issue. I have run the script manually with :

php query_cisco_nbar_all.php rtr001.mydomain.com community 2 index

output:

Get_indexes
walking nbar enable
walk ifindex
Walk protocols

The query still has no counts. I can see the counts on the router for the various protocols. It just seems that the script is unable to get them for Cacti. Any help is greatly appreciated.

Thanks
Kevin

khutton · Post by **khutton** » Thu Jan 15, 2004 1:09 pm

I can get responses when querying the specific interface and protocol. For example here is a query for the 3rd interface (FastEthernet) port 80 overall byte count:

snmp# snmpget -c community rtr001.mydomain.com .cnpdAllStatsInBytes.3.8
CISCO-NBAR-PROTOCOL-DISCOVERY-MIB::cnpdAllStatsInBytes.3.8 = Counter32: 634374307 bytes

I noticed the "bytes" after the value and thought this mught be the issue. Unless the default snmp query Cacti uses has the -OvU switch which truncates the response to only show the value (v) and doesnt print the units (U)

I understand that my router is setup properly and responds with the proper information when I query from the command line. My system is setup correctly but the script is not generating the proper output. I have seen a few people that have gotten the script to work properly. If any one of you read this please respond with the OS you are working with and any pointers to get me going in the right direction.

Thanks
Kevin

Deano · Post by **Deano** » Fri Jan 16, 2004 4:26 am

Kevin

Apologies for not responding earlier I've been distracted by assorted work crisis.

What Hardware and IOS version are you using ? (I think you sent me a mail but I dont have access to my personal mail at work).

I'll Try your IOS on a test box here and see what I get - I may have to send you a version of the script with some extra debug to see if its Getting any response.

Are you using Cacti on Linux or Windows ?

Deano

khutton · Post by **khutton** » Fri Jan 16, 2004 9:33 am

Deano...
No problem on the time. It was mdrain who sent you the email. He is having a similar problem. His post was on the thread in the Scripts forum. I saw that no one had it in the General forum so I posted it here. To answer your questions here is what i am running:

Red Hat Linux 9
NET-SNMP 5.1
PHP 4.3.4
MySQL Standard 4.0.17
Perl 5.8.2
Apache 2.0.48
RRDTool 1.0.45
Cacti .0.8.4
Cisco 2620, IOS 12.3(1a)

Two other things. Mdrain noticed, and I verified, that it seems that the script is looping on looking for interfaces. It never walks the interfaces for the NBAR protocols. If you would like a tcpdump of the query let me know. I also had a post resolving an SNMP issue with values being returned with the units, not just the value.

http://www.raxnet.net/board/viewtopic.php?t=3083

When the data is returned and it has a unit with it, like bytes, it doesnt get written to the rrd file. I thought this might fix the NBAR problem since the return from a command line query includes "634374307 bytes" like below.

snmp# snmpget -c community rtr001.mydomain.com .cnpdAllStatsInBytes.3.8
CISCO-NBAR-PROTOCOL-DISCOVERY-MIB::cnpdAllStatsInBytes.3.8 = Counter32: 634374307 bytes

The edit was made to /cacti/lib/snmp.php to add the -OvU switch to the snmp query, forcing the return of just the numerical value. Like below.

snmp# snmpget -OvU -c community rtr001.mydoamin.com .cnpdAllStatsInBytes.3.8
Counter32: 843945996

This however did not solve the NBAR problem. It did solve my other query problems

, just not NBAR.

Thanks
Kevin

Deano · Post by **Deano** » Fri Jan 16, 2004 10:11 am

Hmmm

Could you do a walk of .1.3.6.1.2.1.2.2.1.2 (interface descriptions). Its possible some odd ifIndex might be screwing it up.

If you could send me the tcpdump aswell (dean@eatworms.org.uk) I'll have a look over the weekend.

Ta
Deano

khutton · Post by **khutton** » Fri Jan 16, 2004 10:40 am

You got it.

khutton · Post by **khutton** » Fri Jan 23, 2004 10:12 am

Hey Deano. Don't want to be a pain, but..... Any news

Deano · Post by **Deano** » Fri Jan 23, 2004 10:55 am

Short answer - no news

Long answer - Looked through your traces and it seems fine. (certainly no ifindex issues!) Appears to be walking the things it should. I need to go back and check it step by step again. Currently trying to get a working Win32 setup - but have had a couple of evenings frustration with getting any php script query to work on that platform. Next step is to also get your IOS on my router. Its a works test router so I can only really fiddle at weekends with it.

Deano

khutton · Post by **khutton** » Fri Jan 23, 2004 11:13 am

Thanks. Just want to make sure your not building the Win32 box for this thread. I am running Red Hat 9.

Is there anything you need from me, or anything I can look into?

Deano · Post by **Deano** » Mon Jan 26, 2004 11:28 am

Kevin

I've now posted the bugfix we worked on. Thanks for your time and help.

For others - The query was breaking if the Cacti server had the NBar MIB loaded as net-snmp was returing some strings instead of numbers.

Deano

khutton · Post by **khutton** » Wed Jan 28, 2004 7:47 am

Sorry about the delay. I haven't been in the office due to snow and ice and the fact that it's just friggin cold outside. I will run the new stuff and report the findings.

khutton · Post by **khutton** » Wed Jan 28, 2004 9:29 am

Ack. Deano. I am gettting an erro during graphing. When i look at graph debug I get this:

ERROR: invalid rpn expression ','

If I run cmp.php from command line I get proper query and value returns. I will look at graph template to see if the issue is there. cAn you look to see if the problem is in any of the scripts?

Thanks,
Kevin

NBAR query problem

NBAR query problem

Who is online