cacti/snmp jumps between linux virtual network interfaces

[simishag]

First, my Cacti installation is working. I've set up Cacti a number of times in the past and never had serious problems. This issue may be more related to net-snmp but I figured I'd ask here first and see if anyone's seen it.

I'm monitoring the NIC on a couple of Linux 2.6.18 servers that have a "main" IP and a couple of virtual IPs. One server is using iproute2, the other is using ifconfig and creating eth1:N interfaces. Linux does seem to do some weird stuff as far as tracking statistics for virtual interfaces. First, there are separate byte counters for the "main" interface and for the virtual interfaces. However, it appears (on my machine at least) that the virtual interfaces all share a single counter, so there are only 2 counters really, the main counter and the aggregate virtual counter.

Monitoring works fine at first, for a few hours at least, until all of a sudden, Cacti or net-snmp jumps from the "main" IP to one of the virtual IPs. The traffic immediately drops to zero and stays there until I restart the NIC. I saw something new today, where on one server, Cacti is jumping between IPs on the NIC; traffic is showing spikes up to 100mbit and then back down to 0. Restarting the NIC, which fixes the problem for a short while, but then it comes back.

Now, I can tell by running a verbose query that Cacti/snmp is jumping to the last IP listed on the interface. If I remove the virtual IPs, then go to the Cacti console and repoll the interface, I'll get the correct single IP, and my graphs are fine. However, if I add the IPs back in and repoll, Cacti will use the last virtual IP. That alone seems kinda silly: if there are multiple possibilities to choose from, the first one returned from snmp is probably the one to choose, but I digress. I also tried removing the virtual IPs, repolling, then adding the virtual IPs without repolling, but eventually Cacti reverts to the last virtual IP.

Anyway, what I would like to do is force Cacti/snmp to look only at the main interface statistics. It seems to be confused by the use of multiple IPs. How can I fix this?

Thanks-
J