Zabbix monitors Cisco switch port 3750 traffic

I will talk about two tips, one about monitoring switch port traffic and the other about store value.

1. Monitor switch port traffic

Switch monitoring document in the production environment on the Internet. Therefore, it is complete, and a key knowledge is interspersed in the middle. Zabbix is still innocent .!!! In this demonstration, I used the production environment Cisco 3750 switch !!! (Only 3750, no other products)

ZABBIX details: click here
ZABBIX: click here

Install and deploy the distributed monitoring system Zabbix 2.06

Install and deploy the distributed monitoring system Zabbix 2.06

Install and deploy Zabbix in CentOS 6.3

Zabbix distributed monitoring system practice

Under CentOS 6.3, Zabbix monitors apache server-status

Monitoring MySQL database Parameters Using Zabbix in CentOS 6.3

Configuration steps:

1. Configure the vswitch SNMP

# Configure terminal

(Config) # snmp-server community test ro creates a user named test and the permission is read-only.

(Config) # snmp-server traps enable allows sending all SNMP traps

(Config) # snmp-server host 10.0.0.1 version 2c test 10.0.0.1 received by the switch

SNMPTrap information

(Config) # snmp-server trap-source loopback0 use the IP address of the loopback0 interface as SNMP

Traps sending Source Address

2. Create a custom template

First, we need to obtain the corresponding OID of Cisco 3750 SNMP. I will put this OID at the bottom of the document.

Here I will talk about port inbound and outbound traffic monitoring. Here is an example of a port. Just copy it with others.

For example, if I want to monitor inbound and outbound traffic of port G1/0/5, what should I do .?

First, you must obtain data directly based on the corresponding OID and determine the data unit to be obtained.

Inbound traffic from Port G1/0/5

Snmpwalk-v 2c-c test 10.0.0.254 1.3.6.1.2.1.2.2.1.10.10105

IF-MIB: ifInOctets.10105 = Counter32: 1663553768

Outbound traffic from Port G1/0/5

Snmpwalk-v 2c-c test 10.0.0.254 1.3.6.1.2.1.2.2.1.16.10105

IF-MIB: ifOutOctets.10105 = Counter32: 2288654478

The first problem was mentioned here. Some people mentioned earlier that zabbix could not monitor the traffic on the switch port. We do not recommend using zabbix to monitor switch traffic. Instead, cacti is used. In fact, there is a problem with cacti, but you didn't meet it !!! The reason is that the data monitored by cacti is larger than that monitored by zabbix. The two sides are inconsistent. Back to question

In fact, to monitor the traffic on the vswitch port, pay attention to the two details.

1. The data unit is bit or bytes.

This concerns the issue of creating items configuration. Sorry, the data above has no unit. What do you want me to find .? The default unit here is bytes. This involves the unit conversion problem.

In cacti, the unit is bit/sec (bps). If zabbix is used, the unit is bps. Without calculation. In this case, zabbix data is more than eight times different from cacti data.

Why .? This is because the unit is not correct !!! Bytes and bit are totally different. If you want to peer

Multiply by 8. Why is it multiplied by 8 .? How does bytes = 8bit multiply the data obtained by zabbix by 8 .? One option in creating items is Use M multiplier. You can add 8 to it. . This makes it easier for you to understand.

2. store value Problems

To do this, you also need to modify the store value, that is, Delta (speed per second). This value corresponds to the counter in cacti, and the problem is solved.

The specific algorithm is: (current value-last value)/(current time-last time)

The results obtained above are stored in the database and then displayed on the WEB side ..

Here, by the way, I have encountered problems. One day, the boss asked me to make the nginx request graph better, instead of displaying the last requests. The value of this request is. The difference between the current value and the previous value is displayed, that is, the change part. At that time, I didn't know how to do it. Sorrow. The impact is that zabbix is not as good as cacti in terms of details. In fact, it's because I didn't learn it !!! Muddy coal, since the store value, and troubles say North-North ah !!

Back to the topic, the story is that we can use the Delta (speed per second) in the store value to implement the change between two values. Achieve the effect of cacti. About store value Everybody still detailed to see the official explanation: https://www.zabbix.com/documentation/2.0/manual/config/items/item pulled so much. To be practical. Directly create items

Based on the items settings created above, basically the traffic will not go wrong. Just use other ports as needed.

Okay, I still missed a problem. Check the document carefully. Have you found any problem with the SNMP value .?

Under Review

IF-MIB: ifOutOctets.10105 = Counter32: 2288654478

What are the problems mentioned here? It is not a Counter32 problem. Why is it a problem .?

Counter32 is a counter of a vswitch, which is a 32-bit counter. It is a constant accumulation starting from 0. What is the maximum value .? 2 ^ power 32 = 4294967296 when the counter reaches 4294967296, it will start from 0 again

Accumulate. A problem occurs here. Counter Overflow !!

In fact, when zabbix is set, if the current value is smaller than the previous value, it is the Counter Overflow. When this problem occurs, Zabbix ignores this value based on speed per second, then take another value. Then, we use the speed per second computing method and store it in the database for display.

As mentioned above, cacti also has a problem. It is actually a 32-bit counter of the switch. A 32-bit counter can represent a maximum of 4 GB of traffic. If the counter overflows once within the collection time, the difference between the previous collection value and the current collection value is more than 4 GB, and when the traffic reaches 109.225 Mbps, the problem arises. 4G/300*8 = 109.225 Mbps 300 = 5*60 simultaneously cacti and zabbix think that the last difference from the current collection is normal after the overflow, it is not considered that the difference value is caused by overflow.

Solution:

1. Adjust the value interval quickly, for example, once every 1 minute. In this way, no problem exists.

2. Use a 64-bit counter. You can check the switch manual to see if the switch supports 64-bit counters. The next generation switch supports all 64-bit counters. If the current production environment does not support 64-bit counters, use the first method. Speed up the value interval ..

In view of the above problem, fat brother actually encountered this problem. --

Now, the document code is complete. I hope to help you. Thank you !!!!!

Oh, by the way, the differential OID list

Obtain the port list and description

Snmpwalk-v 2c-c test IP 1.3.6.1.2.1.2.2.1.2

Obtain the port UP/DOWN status

Snmpwalk-v 2c-c test IP 1.3.6.1.2.1.2.2.1.8

Get inbound port traffic (byte)

Snmpwalk-v 2c-c test IP 1.3.6.1.2.1.2.2.1.10

Get outbound port traffic (byte)

Snmpwalk-v 2c-c test IP 1.3.6.1.2.1.2.2.1.16

Obtain the cpu load (percentage) in the past 5 seconds)

Snmpwalk-v 2c-c test IP 1.3.6.1.4.1.9.2.1.56.0

Obtain the cpu load in the past 10 seconds (percentage)

Snmpwalk-v 2c-c test IP 1.3.6.1.4.1.9.2.1.57.0

Obtain the cpu load (percentage) in the past 15 seconds)

Snmpwalk-v 2c-c test IP 1.3.6.1.4.1.9.2.1.58.0

Obtain memory usage

Snmpwalk-v 2c-c test IP 1.3.6.1.4.1.9.48.1.1.1.5

Obtain memory idle status

Snmpwalk-v 2c-c test IP 1.3.6.1.4.1.9.9.48.1.1.1.6