Getting interface traffic data from SNMP

[sauron]

I'm trying to monitor a number of Solaris hosts, and my network usage graphs are frequently nonsensical, as some Sun platforms don't seem to report usage correctly. Has anyone else seen this kind of thing, and is there an answer?

On a SunFire T1000, which is a 64 bit SPARC running Solaris 10, I get:-

Code: Select all

# snmpwalk -v 1 -c public localhost .1.3.6.1.2.1.2.2.1.16; sleep 10; snmpwalk -v 1 -c public localhost .1.3.6.1.2.1.2.2.1.16
IF-MIB::ifOutOctets.1 = Counter32: 0
IF-MIB::ifOutOctets.2 = Counter32: 1130444817
IF-MIB::ifOutOctets.3 = Counter32: 448
IF-MIB::ifOutOctets.1 = Counter32: 0
IF-MIB::ifOutOctets.2 = Counter32: 1179165808
IF-MIB::ifOutOctets.3 = Counter32: 448

That works out to a data rate of about 37Mbps, which is pretty much what I'm expecting from this box. On a SunFire X4100 (64 bit Opteron) which is part of the same cluster, I get:-

Code: Select all

# snmpwalk -v 1 -c public localhost .1.3.6.1.2.1.2.2.1.16; sleep 10; snmpwalk -v 1 -c public localhost .1.3.6.1.2.1.2.2.1.16
IF-MIB::ifOutOctets.1 = Counter32: 0
IF-MIB::ifOutOctets.2 = Counter32: 957267
IF-MIB::ifOutOctets.3 = Counter32: 656354
IF-MIB::ifOutOctets.1 = Counter32: 0
IF-MIB::ifOutOctets.2 = Counter32: 957697
IF-MIB::ifOutOctets.3 = Counter32: 656354

which gives a data rate of < 1Kbps on interface 2, and zero on 3. Looking at the traffic to that host from my load balancer, I should be seeing about 20-25Mbps on each interface. Neither machine supports the ifXTable (both are running the Solaris SNMP daemon, which is actually just net-snmpd), so I was hoping someone else here might have encountered this problem in the past and know a way round it.

Mike

[Mourph]

I have this exact same problem.. i simply want to graph solaris 10 x4100 hosts interface traffic. my results are identical to yours. the only difference is this specific box has a lot of interfaces aliases

# snmpwalk -v2c -c public myserverip .1.3.6.1.2.1.2.2.1.16 | head -5 ; sleep 10 ; snmpwalk -v2c -c public myserverip .1.3.6.1.2.1.2.2.1.16 | head -5
IF-MIB::ifOutOctets.1 = Counter32: 0
IF-MIB::ifOutOctets.2 = Counter32: 2305
IF-MIB::ifOutOctets.3 = Counter32: 0
IF-MIB::ifOutOctets.4 = Counter32: 0
IF-MIB::ifOutOctets.5 = Counter32: 0
IF-MIB::ifOutOctets.1 = Counter32: 0
IF-MIB::ifOutOctets.2 = Counter32: 2305
IF-MIB::ifOutOctets.3 = Counter32: 0
IF-MIB::ifOutOctets.4 = Counter32: 0
IF-MIB::ifOutOctets.5 = Counter32: 0


it seems the solaris 10 ucd-snmp daemon has some issues, judging by a quick graph on my switchport, i'm pushing around 8Mbit on this interface....

any idea's or comments are certainly welcome!

[sauron]

I have done a reasonable amount of searching on this, with no real success. I've removed the Sun SNMP packages from a couple of systems, and replaced them with a self-built package of Net-SNMP 5.3.1, which seems to produce better (but still wrong) bandwidth stats. Net-SNMP 5.4, which is currently the CVS version, is supposed to support ifXTable on Solaris, so hopefully the 64 bit interface counters will work properly. When I tried a nightly snapshot I found that the CPU statistics didn't work any more. When I mailed the net-snmp list about this I got this response from one of the developers:-

The latest CVS code has started to use a new "hardware abstraction
layer" to retrieve the systemStats information. This can be found
under 'agent/mibgroup/hardware/cpu'.
The Solaris version is 'cpu_kstat.c'

I'd tested this re-write on all the systems I have access to, but that
doesn't include Solaris kit. While I tried to copy the previous code
as much as I could, it's quite possible that there's a minor (or
major) bug that's stopping this from working on such architectures.
Assistance from Solaris developers would be most welcome.

This was three weeks ago - so the latest CVS may have fixed it again. My view at the moment is that Sun have adopted Net-SNMP for Solaris, but haven't adequately tested the version they're shipping, and aren't providing enough resources to the Net-SNMP project. If lead developers can't get easy access to Sun hardware and Sun aren't debugging it themselves, there's a bit of a problem. I'm in the process of trying to follow up with my Sun representative, but finding someone in Sun who has answers isn't always easy.

When I get time I'll try 5.4pre3 - until then, I'm stuck..... If you get any useful info back, please post.