Solve the problem of inaccurate network traffic monitored by ZABBIX with SNMP

The company has a new data center , Need to use zabbix Monitor the network traffic of Huasan switch .

Match well snmp After the agreement , Normal can recognize , But slowly found a problem , There is often a lack of data in the interface of telecommunications , But China Unicom and China Railway connect have no problems .

zabbix The drawing is intermittent , Sometimes the more magical thing is , There's a sudden drop in traffic , The decline is still outrageous , from 500 many Mbps Fall to 40 many Mbps, Once thought that there was a problem with the data returned by the switch .

Later on zabbix Grab bags on the machine , It is found that the data packet is not lost , There is nothing unusual about the data , But in my bag , There is one counter32 Draw attention .

Then read carefully snmp Documents , Find out snmp The agreement returned ifInOctets and ifOutOctets Are the total amount of traffic , And we all take the difference between two times , Then divide by the sampling interval , The average value obtained .

and counter32 The maximum value of the data type count of is 2 Of 32 The power minus 1, When more than 4G When , The counter will be cleared .

Later, it was analyzed that zabbix Of snmp interface The template of , Find out zabbix The sampling time is 1 minute , In our case, due to the large traffic , It will be cleared soon , And sometimes count the new value after clearing , Bigger than the last count ,zabbix I thought I hadn't cleared zero , Direct subtraction with time intervals , That's why “ The illusion of a steep drop in network traffic ”.

After finding out why , The rest is easy to handle , What we need , Use counter64 Of oid data .

stay zabbix Derived from template snmp interfaces Templates , Then change the name , Re import . Modify this new template ：

stay “ Explore the rules ” Find “ Project prototype ”, Click on “Incoming traffic on interface {#SNMPVALUE}”,

1. Put it “ Key value ” Medium ifInOctets[{#SNMPVALUE}] It is amended as follows ifHCInOctets[{#SNMPVALUE}]

2. take “SNMP OID” Medium IF-MIB::ifInOctets.{#SNMPINDEX} It is amended as follows IF-MIB::ifHCInOctets.{#SNMPINDEX}

Again ：“ Project prototype ” Medium “Outgoing traffic on interface {#SNMPVALUE}” Make similar changes .

Also is to ifInOctets and ifOutOctets Replace with ifHCInOctets and ifHCOutOctets.

Then delete the host , Re add the host , Everything is fresh this time , The drawings are continuous , There is no problem of steep rise and fall again .