Can't monitor Win2k3 server traffic

Post support questions that relate to the Windows 2003/2000/XP operating systems.

Moderators: Developers, Moderators

ycflash
Posts: 13
Joined: Thu Nov 17, 2005 9:18 pm
Location: BJ, China

Can't monitor Win2k3 server traffic

Post by ycflash »

I am using Cacti 0.8.6g to monitor FTP server traffic, both linux and windows 2003 server. With linux server, there is no problem. But cacti cannot monitor my Windows 2003 traffic with 64bit counter. Because these server have over 100MB traffic on average, I need to use 64 bit counter to monitor them.
Win2k3 use the system provided SNMP service.

Why? Please help me.
User avatar
BSOD2600
Cacti Moderator
Posts: 12171
Joined: Sat May 08, 2004 12:44 pm
Location: USA

Post by BSOD2600 »

1) Does SNMP v1 work?
2) When you use snmpwalk on your windows host, does it return anything in SNMP 1 or 2c mode? i.e. snmpwalk -v 2c -c public 127.0.0.1 .1.3.6.1.2.1.2.2
ycflash
Posts: 13
Joined: Thu Nov 17, 2005 9:18 pm
Location: BJ, China

Post by ycflash »

BSOD2600 wrote:1) Does SNMP v1 work?
2) When you use snmpwalk on your windows host, does it return anything in SNMP 1 or 2c mode? i.e. snmpwalk -v 2c -c public 127.0.0.1 .1.3.6.1.2.1.2.2
Yes, SNMP v1 and v2 works. I can get the results.

When I use cacti to collect traffic information by 64 bit counter, nothing graphed.
User avatar
BSOD2600
Cacti Moderator
Posts: 12171
Joined: Sat May 08, 2004 12:44 pm
Location: USA

Post by BSOD2600 »

1) Did you tell cacti to use SNMP v2 on that device?
2) Did you select the 64bit graph template?
3) Do you have net-snmp installed? If so, what version?
4) Turn the logging level to debug for a cycle and look in it for Cacti polling the windows 2003 device. It return any data?
ycflash
Posts: 13
Joined: Thu Nov 17, 2005 9:18 pm
Location: BJ, China

Post by ycflash »

BSOD2600 wrote:1) Did you tell cacti to use SNMP v2 on that device?
2) Did you select the 64bit graph template?
3) Do you have net-snmp installed? If so, what version?
4) Turn the logging level to debug for a cycle and look in it for Cacti polling the windows 2003 device. It return any data?
1) yes
2) yes, if not 64bit counter, i can get the graph, but not the actual traffic.
3) windows system's
4) the following is the log: (host ip hided)
BSOD2600 wrote:
11/18/2005 03:00:01 PM - POLLER: Poller[0] DEBUG: About to Spawn a Remote Process [CMD: /usr/local/bin/php, ARGS: -q /usr/local/ftpadminweb/cacti/cmd.php 0 0]
11/18/2005 03:00:01 PM - POLLER: Poller[0] DEBUG: About to Spawn a Remote Process [CMD: /usr/local/bin/php, ARGS: -q /usr/local/ftpadminweb/cacti/cmd.php 32 32]
11/18/2005 03:00:01 PM - CMDPHP: Poller[0] ERROR: Either there are no items in the cache or polling is disabled
11/18/2005 03:00:01 PM - PHPSVR: Poller[0] DEBUG: SERVER: cmd
11/18/2005 03:00:01 PM - PHPSVR: Poller[0] DEBUG: GETCWD: /
11/18/2005 03:00:01 PM - PHPSVR: Poller[0] DEBUG: DIRNAM: /usr/local/ftpadminweb/cacti
11/18/2005 03:00:01 PM - PHPSVR: Poller[0] DEBUG: FILENM: /usr/local/ftpadminweb/cacti/script_server.php
11/18/2005 03:00:01 PM - PHPSVR: Poller[0] PHP Script Server has Started - Parent is cmd
11/18/2005 03:00:01 PM - CMDPHP: Poller[0] PHP Script Server Started Properly
11/18/2005 03:00:01 PM - CMDPHP: Poller[0] Host[32] PING: Host is Alive
11/18/2005 03:00:01 PM - CMDPHP: Poller[0] Host[32] SNMP: Host responded to SNMP
11/18/2005 03:00:01 PM - CMDPHP: Poller[0] Host[32] RECACHE: Processing 3 items in the auto reindex cache for '127.0.0.1'.
11/18/2005 03:00:01 PM - CMDPHP: Poller[0] Host[32] DS[588] WARNING: Result from SNMP not valid. Partial Result: No Such Object avail
11/18/2005 03:00:01 PM - CMDPHP: Poller[0] Host[32] DS[588] SNMP: v2: 127.0.0.1, dsname: traffic_in, oid: .1.3.6.1.2.1.31.1.1.1.6.65539, output: U
11/18/2005 03:00:01 PM - CMDPHP: Poller[0] Host[32] DS[588] WARNING: Result from SNMP not valid. Partial Result: No Such Object avail
11/18/2005 03:00:01 PM - CMDPHP: Poller[0] Host[32] DS[588] SNMP: v2: 127.0.0.1, dsname: traffic_out, oid: .1.3.6.1.2.1.31.1.1.1.10.65539, output: U
11/18/2005 03:00:01 PM - PHPSVR: Poller[0] DEBUG: PHP Script Server Shutdown request received, exiting
11/18/2005 03:00:01 PM - CMDPHP: Poller[0] Time: 0.4205 s, Theads: N/A, Hosts: 1
11/18/2005 03:00:02 PM - POLLER: Poller[0] CACTI2RRD: /usr/local/rrdtool-1.0.50/bin/rrdtool update /usr/local/ftpadminweb/cacti/rra/tv2_win_traffic_in_588.rrd --template traffic_in:traffic_out 1132297201:U:U
11/18/2005 03:00:02 PM - SYSTEM STATS: Time:1.0376 Method:cmd.php Processes:100 Threads:N/A Hosts:2 HostsPerProcess:1 DataSources:2 RRDsProcessed:1
11/18/2005 03:00:02 PM - POLLER: Poller[0] DEBUG: About to Spawn a Remote Process [CMD: /usr/local/bin/php, ARGS: -q /usr/local/ftpadminweb/cacti/poller_commands.php]
11/18/2005 03:00:02 PM - POLLER: Poller[0] DEBUG: About to Spawn a Remote Process [CMD: /usr/local/bin/php, ARGS: -q /usr/local/ftpadminweb/cacti/poller_export.php]
11/18/2005 03:00:02 PM - EXPORT STATS: ExportTime:0.0030 TotalGraphs:
ycflash
Posts: 13
Joined: Thu Nov 17, 2005 9:18 pm
Location: BJ, China

Post by ycflash »

I tried net-snmp 5.2.1 for windows binary, by using snmpget , the answer is no this OID, the OID I use is from the log.
User avatar
BSOD2600
Cacti Moderator
Posts: 12171
Joined: Sat May 08, 2004 12:44 pm
Location: USA

Post by BSOD2600 »

1) Click the green circle next to the snmp interface query for the device. That will refresh the interface index.

2) post the verbose query log for the snmp interface.
ycflash
Posts: 13
Joined: Thu Nov 17, 2005 9:18 pm
Location: BJ, China

Post by ycflash »

BSOD2600 wrote:1) Click the green circle next to the snmp interface query for the device. That will refresh the interface index.

2) post the verbose query log for the snmp interface.
here it is:
11/18/2005 04:00:01 PM - POLLER: Poller[0] DEBUG: About to Spawn a Remote Process [CMD: /usr/local/bin/php, ARGS: -q /usr/local/ftpadminweb/cacti/cmd.php 0 0]
11/18/2005 04:00:01 PM - POLLER: Poller[0] DEBUG: About to Spawn a Remote Process [CMD: /usr/local/bin/php, ARGS: -q /usr/local/ftpadminweb/cacti/cmd.php 32 32]
11/18/2005 04:00:01 PM - CMDPHP: Poller[0] ERROR: Either there are no items in the cache or polling is disabled
11/18/2005 04:00:01 PM - PHPSVR: Poller[0] DEBUG: SERVER: cmd
11/18/2005 04:00:01 PM - PHPSVR: Poller[0] DEBUG: GETCWD: /
11/18/2005 04:00:01 PM - PHPSVR: Poller[0] DEBUG: DIRNAM: /usr/local/ftpadminweb/cacti
11/18/2005 04:00:01 PM - PHPSVR: Poller[0] DEBUG: FILENM: /usr/local/ftpadminweb/cacti/script_server.php
11/18/2005 04:00:01 PM - PHPSVR: Poller[0] PHP Script Server has Started - Parent is cmd
11/18/2005 04:00:01 PM - CMDPHP: Poller[0] PHP Script Server Started Properly
11/18/2005 04:00:01 PM - CMDPHP: Poller[0] Host[32] PING: Host is Alive
11/18/2005 04:00:01 PM - CMDPHP: Poller[0] Host[32] SNMP: Host responded to SNMP
11/18/2005 04:00:01 PM - CMDPHP: Poller[0] Host[32] RECACHE: Processing 1 items in the auto reindex cache for '127.0.0.1'.
11/18/2005 04:00:01 PM - CMDPHP: Poller[0] Host[32] DS[588] WARNING: Result from SNMP not valid. Partial Result: No Such Object avail
11/18/2005 04:00:01 PM - CMDPHP: Poller[0] Host[32] DS[588] SNMP: v2: 127.0.0.1, dsname: traffic_out, oid: .1.3.6.1.2.1.31.1.1.1.10.65539, output: U
11/18/2005 04:00:01 PM - CMDPHP: Poller[0] Host[32] DS[588] WARNING: Result from SNMP not valid. Partial Result: No Such Object avail
11/18/2005 04:00:01 PM - CMDPHP: Poller[0] Host[32] DS[588] SNMP: v2: 127.0.0.1, dsname: traffic_in, oid: .1.3.6.1.2.1.31.1.1.1.6.65539, output: U
11/18/2005 04:00:01 PM - PHPSVR: Poller[0] DEBUG: PHP Script Server Shutdown request received, exiting
11/18/2005 04:00:01 PM - CMDPHP: Poller[0] Time: 0.3199 s, Theads: N/A, Hosts: 1
11/18/2005 04:00:02 PM - POLLER: Poller[0] CACTI2RRD: /usr/local/rrdtool-1.0.50/bin/rrdtool update /usr/local/ftpadminweb/cacti/rra/tv2_win_traffic_in_588.rrd --template traffic_out:traffic_in 1132300801:U:U
11/18/2005 04:00:02 PM - SYSTEM STATS: Time:1.0321 Method:cmd.php Processes:100 Threads:N/A Hosts:2 HostsPerProcess:1 DataSources:2 RRDsProcessed:1
11/18/2005 04:00:02 PM - POLLER: Poller[0] DEBUG: About to Spawn a Remote Process [CMD: /usr/local/bin/php, ARGS: -q /usr/local/ftpadminweb/cacti/poller_commands.php]
11/18/2005 04:00:02 PM - POLLER: Poller[0] DEBUG: About to Spawn a Remote Process [CMD: /usr/local/bin/php, ARGS: -q /usr/local/ftpadminweb/cacti/poller_export.php]
11/18/2005 04:00:02 PM - EXPORT STATS: ExportTime:0.0031 TotalGraphs:
User avatar
BSOD2600
Cacti Moderator
Posts: 12171
Joined: Sat May 08, 2004 12:44 pm
Location: USA

Post by BSOD2600 »

You didn't post the verbose query of 'SNMP - Interface Statistics' in Associated Data Queries.

Humor me and post a net-snmp snmpwalk of the interfaces.
ycflash
Posts: 13
Joined: Thu Nov 17, 2005 9:18 pm
Location: BJ, China

Post by ycflash »

BSOD2600 wrote:You didn't post the verbose query of 'SNMP - Interface Statistics' in Associated Data Queries.

Oh, sorry.

verbose message:
+ Running data query [1].
+ Found type = '3' [snmp query].
+ Found data query XML file at '/usr/local/ftpadminweb/cacti/resource/snmp_queries/interface.xml'
+ XML file parsed ok.
+ Executing SNMP walk for list of indexes @ '.1.3.6.1.2.1.2.2.1.1'
+ Located input field 'ifIndex' [walk]
+ Executing SNMP walk for data @ '.1.3.6.1.2.1.2.2.1.1'
+ Found item [ifIndex='1'] index: 1 [from value]
+ Found item [ifIndex='65539'] index: 65539 [from value]
+ Located input field 'ifOperStatus' [walk]
+ Executing SNMP walk for data @ '.1.3.6.1.2.1.2.2.1.8'
+ Found item [ifOperStatus='1'] index: 1 [from value]
+ Found item [ifOperStatus='1'] index: 65539 [from value]
+ Located input field 'ifDescr' [walk]
+ Executing SNMP walk for data @ '.1.3.6.1.2.1.2.2.1.2'
+ Found item [ifDescr='MS TCP Loopback interface'] index: 1 [from value]
+ Found item [ifDescr='Intel(R) PRO/1000 CT Network Connection'] index: 65539 [from value]
+ Located input field 'ifName' [walk]
+ Executing SNMP walk for data @ '.1.3.6.1.2.1.31.1.1.1.1'
+ Located input field 'ifAlias' [walk]
+ Executing SNMP walk for data @ '.1.3.6.1.2.1.31.1.1.1.18'
+ Located input field 'ifType' [walk]
+ Executing SNMP walk for data @ '.1.3.6.1.2.1.2.2.1.3'
+ Found item [ifType='24'] index: 1 [from value]
+ Found item [ifType='6'] index: 65539 [from value]
+ Located input field 'ifSpeed' [walk]
+ Executing SNMP walk for data @ '.1.3.6.1.2.1.2.2.1.5'
+ Found item [ifSpeed='10000000'] index: 1 [from value]
+ Found item [ifSpeed='1000000000'] index: 65539 [from value]
+ Located input field 'ifHwAddr' [walk]
+ Executing SNMP walk for data @ '.1.3.6.1.2.1.2.2.1.6'
+ Found item [ifHwAddr=''] index: 1 [from value]
+ Found item [ifHwAddr='00:04:23:B8:E0:20'] index: 65539 [from value]
+ Located input field 'ifIP' [walk]
+ Executing SNMP walk for data @ '.1.3.6.1.2.1.4.20.1.2'
+ Found item [ifIP='127.0.0.1'] index: 1 [from regexp oid parse]
+ Found item [ifIP='211.68.71.93'] index: 65539 [from regexp oid parse]
+ Found data query XML file at '/usr/local/ftpadminweb/cacti/resource/snmp_queries/interface.xml'
+ Found data query XML file at '/usr/local/ftpadminweb/cacti/resource/snmp_queries/interface.xml'
+ Found data query XML file at '/usr/local/ftpadminweb/cacti/resource/snmp_queries/interface.xml'
+ Found data query XML file at '/usr/local/ftpadminweb/cacti/resource/snmp_queries/interface.xml'
BSOD2600 wrote: post a net-snmp snmpwalk of the interfaces.
I don't understand.
User avatar
BSOD2600
Cacti Moderator
Posts: 12171
Joined: Sat May 08, 2004 12:44 pm
Location: USA

Post by BSOD2600 »

Run: snmpwalk -v 2c -c public 127.0.0.1 .1.3.6.1.2.1.2.2

You running SP1 on windows 2003?
ycflash
Posts: 13
Joined: Thu Nov 17, 2005 9:18 pm
Location: BJ, China

Post by ycflash »

BSOD2600 wrote:Run: snmpwalk -v 2c -c public 127.0.0.1 .1.3.6.1.2.1.2.2

You running SP1 on windows 2003?
here is the output:
IF-MIB::ifIndex.1 = INTEGER: 1
IF-MIB::ifIndex.65539 = INTEGER: 65539
IF-MIB::ifDescr.1 = STRING: MS TCP Loopback interface
IF-MIB::ifDescr.65539 = STRING: Intel(R) PRO/1000 CT Network Connection
IF-MIB::ifType.1 = INTEGER: softwareLoopback(24)
IF-MIB::ifType.65539 = INTEGER: ethernetCsmacd(6)
IF-MIB::ifMtu.1 = INTEGER: 1520
IF-MIB::ifMtu.65539 = INTEGER: 1500
IF-MIB::ifSpeed.1 = Gauge32: 10000000
IF-MIB::ifSpeed.65539 = Gauge32: 1000000000
IF-MIB::ifPhysAddress.1 = STRING:
IF-MIB::ifPhysAddress.65539 = STRING: 0:4:23:b8:e0:20
IF-MIB::ifAdminStatus.1 = INTEGER: up(1)
IF-MIB::ifAdminStatus.65539 = INTEGER: up(1)
IF-MIB::ifOperStatus.1 = INTEGER: up(1)
IF-MIB::ifOperStatus.65539 = INTEGER: up(1)
IF-MIB::ifLastChange.1 = Timeticks: (0) 0:00:00.00
IF-MIB::ifLastChange.65539 = Timeticks: (0) 0:00:00.00
IF-MIB::ifInOctets.1 = Counter32: 50398142
IF-MIB::ifInOctets.65539 = Counter32: 1380106227
IF-MIB::ifInUcastPkts.1 = Counter32: 978658
IF-MIB::ifInUcastPkts.65539 = Counter32: 1322890448
IF-MIB::ifInNUcastPkts.1 = Counter32: 0
IF-MIB::ifInNUcastPkts.65539 = Counter32: 1376454
IF-MIB::ifInDiscards.1 = Counter32: 0
IF-MIB::ifInDiscards.65539 = Counter32: 0
IF-MIB::ifInErrors.1 = Counter32: 0
IF-MIB::ifInErrors.65539 = Counter32: 0
IF-MIB::ifInUnknownProtos.1 = Counter32: 0
IF-MIB::ifInUnknownProtos.65539 = Counter32: 0
IF-MIB::ifOutOctets.1 = Counter32: 50398142
IF-MIB::ifOutOctets.65539 = Counter32: 2310506892
IF-MIB::ifOutUcastPkts.1 = Counter32: 978491
IF-MIB::ifOutUcastPkts.65539 = Counter32: 1347898186
IF-MIB::ifOutNUcastPkts.1 = Counter32: 0
IF-MIB::ifOutNUcastPkts.65539 = Counter32: 20418
IF-MIB::ifOutDiscards.1 = Counter32: 0
IF-MIB::ifOutDiscards.65539 = Counter32: 0
IF-MIB::ifOutErrors.1 = Counter32: 0
IF-MIB::ifOutErrors.65539 = Counter32: 0
IF-MIB::ifOutQLen.1 = Gauge32: 0
IF-MIB::ifOutQLen.65539 = Gauge32: 0
IF-MIB::ifSpecific.1 = OID: SNMPv2-SMI::zeroDotZero
IF-MIB::ifSpecific.65539 = OID: SNMPv2-SMI::zeroDotZero
yes, win2k3 with sp1.
User avatar
TheWitness
Developer
Posts: 17061
Joined: Tue May 14, 2002 5:08 pm
Location: MI, USA
Contact:

Post by TheWitness »

BSOD,

Too much college and not enough Cacti.

ycflash,

Please walk the following OID: .1.3.6.1.2.1.31.1.1.1.6. It is likely that your Windows box does not support 64bit counters. The only solutions would be to:

1) Not use the box as hard
2) Call your hardware vendor for a new driver,
3) Call Microsoft and complain about their SNMP support
4) Use someone elses agent
5) Poll more frequently and change your template accordingly

TheWitness
True understanding begins only when we realize how little we truly understand...

Life is an adventure, let yours begin with Cacti!

Author of dozens of Cacti plugins and customization's. Advocate of LAMP, MariaDB, IBM Spectrum LSF and the world of batch. Creator of IBM Spectrum RTM, author of quite a bit of unpublished work and most of Cacti's bugs.
_________________
Official Cacti Documentation
GitHub Repository with Supported Plugins
Percona Device Packages (no support)
Interesting Device Packages


For those wondering, I'm still here, but lost in the shadows. Yearning for less bugs. Who want's a Cacti 1.3/2.0? Streams anyone?
ycflash
Posts: 13
Joined: Thu Nov 17, 2005 9:18 pm
Location: BJ, China

Post by ycflash »

TheWitness wrote:BSOD,

Too much college and not enough Cacti.

ycflash,

Please walk the following OID: .1.3.6.1.2.1.31.1.1.1.6. It is likely that your Windows box does not support 64bit counters. The only solutions would be to:

1) Not use the box as hard
2) Call your hardware vendor for a new driver,
3) Call Microsoft and complain about their SNMP support
4) Use someone elses agent
5) Poll more frequently and change your template accordingly

TheWitness
It seams that win2k3 doesn't support this OID:.1.3.6.1.2.1.31.1.1.1.6
Do I need to compile net-snmp from source?
User avatar
BSOD2600
Cacti Moderator
Posts: 12171
Joined: Sat May 08, 2004 12:44 pm
Location: USA

Post by BSOD2600 »

My Windows XP Pro SP2 and Win2K3 SP1 boxes do not support the OID .1.3.6.1.2.1.31.1.1.1.6. Must be a net-snmp or Linux thing...

Win2K3 does support SNMP2 and 64bit counters, but just not that OID.
Post Reply

Who is online

Users browsing this forum: No registered users and 6 guests