Solve the problem of Zabbix monitoring network traffic with SNMP

The company has a new data center that requires Zabbix to monitor the network traffic of the three switches.

With the SNMP protocol, the normal can be recognized, but slowly found a problem, the telecommunications interface often appear less data, but Unicom and CRC are no problem.

Zabbix plot of the picture intermittent, and sometimes even more magical, the traffic suddenly dropped, the fall is also very outrageous, from 500 Mbps down to more than 40 Mbps, once thought to be the switch returned data has a problem.

Later on the Zabbix machine grabbed the packet, found that the packet has not been lost, the data is not anything unusual, but grabbed the bag inside, there is a counter32 attract attention.

Then read the SNMP document carefully, found that the SNMP protocol returns the ifinoctets and Ifoutoctets are the total amount of traffic, and we all take two times the difference, and then divided by the sampling interval time, the average value.

The maximum value of the Counter32 data type count is 2 of 32 minus 1, and when it exceeds 4G, the counter is zeroed out.

Later analysis of the Zabbix SNMP interface template, found that the Zabbix sampling time is 1 minutes, in our due to large flow, quickly cleared, and sometimes counted 0 after the new value, more than the last count, Zabbix thought not clear 0, The direct subtraction is divided by the time interval, resulting in "the illusion of a steep drop in network traffic".

After finding the reason, the rest is good, and what we need is to use the OID data of counter64.

Export Template SNMP interfaces templates in Zabbix, then modify the name and re-import. To modify this new template:

Find "project prototype" in "Explore Rule", click "Incoming traffic on interface {#SNMPVALUE}",

1. Modify the ifinoctets[{#SNMPVALUE}] in its "key value" to ifhcinoctets[{#SNMPVALUE}]

2. The if-mib::ifinoctets in the "SNMP OID". {#SNMPINDEX} is modified to if-mib::ifhcinoctets. {#SNMPINDEX}

Similarly, "outgoing traffic on interface {#SNMPVALUE}" in the "project prototype" also makes similar modifications.

That is to replace Ifinoctets and ifoutoctets with Ifhcinoctets and ifhcoutoctets.

Then the host deleted, re-add the host, this time everything is refreshing, the drawings are continuous, there is no more sudden steep drop of the problem.

Solve the problem of Zabbix monitoring network traffic with SNMP