Cisco SNMP – Exporting IF-MIB Stats Interval in Cisco IOS

ciscomanagementroutersnmp

I'm developing a SNMP Monitor for my company. I've done it before, and that is why I'm not sure why I have the behavior, and because I'm not a network engineer, I'm not a 100% sure where to go and trouble shoot the problem.

I'm requesting OID 1.3.6.1.2.1.2.2.1.10 (In Octets for an interface) and I receive a value. However, If I request it again 5 seconds later, I get exactly the same value, but 5 seconds later there is movement. If I request it every 10 seconds, there is movement all the time. (I do request the Out Octets as well, and experience the same behavior)

If I log on to the router and I run sh int fastEthernet 0/0/0 the input bytes changes the whole time like I expect.

At my previous company I did a similar monitor, and I requested the value every 2 seconds, and it worked fine. Unfortunately I cannot remember the series of the Cisco routers there.

Running Wireshark I see the requests and responses, and the response from the router definitely returns the same value.

I have 3 questions regarding this.

Is there a setting or configuration that I can set?
Will it be better to use traps instead of query?
Is this native to the 1900 series to only update the SNMP agent (forgive me if this is the wrong terminology) like it is doing at the moment.

Any help in any direction will be appreciated. If there is any information that you need that I might have left out, please ask. Like I said, I'm not a network engineer.

Thanks in advance

Best Answer

Is this native to the 1900 series to only update the SNMP agent (forgive me if this is the wrong terminology) like it is doing at the moment.

What you're seeing is expected behavior. IOS has cached IF-MIB statistics for on 10-second intervals (by default) for a while, for instance see this entry in the SNMP FAQ.

That said, I have a few switches which seem to defy this "typical" 10-second SNMP stats export interval.

Is there a setting or configuration that I can set?

Use service counters max age [age-in-seconds]; this command will show up in the running configuration; however, it's not available in older versions of IOS.

You can also change the IF-MIB 64-bit counters to update interval with this hidden command: snmp-server hc poll [interval], where the interval is measured in hundredths of seconds; however, this command will not show up in the running configuration.

Will it be better to use traps instead of query?

It won't matter whether you push or pull, unless your platform exports the stats quickly enough.

Related Solutions

Routing – n SNMP MIB for Cisco Track Objects

I don't believe there is a way to directly poll the results of the OR via SNMP, but you can certainly poll for the IP SLA results and calculate it yourself.

Using the CISCO-RTTMON-MIB (1.3.6.1.4.1.9.9.42), you can check the timeout value of your reachability checks, take the true/false value it returns and do the OR in whatever scripting language you're using to poll via SNMP.

For example, I setup a similar test to yours above:

track 10 ip sla 1 reachability
!
track 20 ip sla 2 reachability
!
track 30 list boolean or
 object 10
 object 20
!
ip sla 1
 icmp-echo 8.8.8.8 source-ip 10.129.10.62
ip sla schedule 1 life forever start-time now
ip sla 2
 icmp-echo 4.2.2.2 source-ip 10.129.10.62
ip sla schedule 2 life forever start-time now
!
ip route 10.171.20.0 255.255.255.252 10.129.10.61 track 30

Then, I verified the output in IOS:

R-VOIPLAB#show track 30
Track 30
  List boolean or
  Boolean OR is Up
    2 changes, last change 00:01:21
    object 10 Up
    object 20 Up

Next, with the IP SLA tracking in place, I installed the CISCO-RTTMON-MIB on my monitoring server, and walked the value of rttMonCtrlOperTimeoutOccurred (1.3.6.1.4.1.9.9.42.1.2.9.1.6) for it's True/False output.

The key item to note is that since we are polling whether a timeout occurred or not, that False means that the destination is reachable, and True means that it is not reachable and a timeout has occurred.

snmpwalk -v3 -a SHA -A SNMP-AUTH-PASS -l authNoPriv -u SNMPUSER r-voiplab rttMonCtrlOperTimeoutOccurred
CISCO-RTTMON-MIB::rttMonCtrlOperTimeoutOccurred.1 = INTEGER: false(2)
CISCO-RTTMON-MIB::rttMonCtrlOperTimeoutOccurred.2 = INTEGER: false(2)

Finally, I blackholed traffic to 8.8.8.8 from that box, and checked the Track results in IOS again:

R-VOIPLAB(config)#ip route 8.8.8.8 255.255.255.255 null 0
R-VOIPLAB(config)#end
R-VOIPLAB#show track 30
Track 30
  List boolean or
  Boolean OR is Up
    2 changes, last change 00:21:18
    object 10 Down
    object 20 Up
  Tracked by:
    STATIC-IP-ROUTING 0

Now that we have one of the test objects in a Down state, let us see the results of polling rttMonCtrlOperTimeoutOccurred again:

snmpwalk -v3 -a SHA -A SNMP-AUTH-PASS -l authNoPriv -u SNMPUSER r-voiplab rttMonCtrlOperTimeoutOccurred
CISCO-RTTMON-MIB::rttMonCtrlOperTimeoutOccurred.1 = INTEGER: true(1)
CISCO-RTTMON-MIB::rttMonCtrlOperTimeoutOccurred.2 = INTEGER: false(2)

Now, as I stated above, you would just have to poll those values and use them however you need to in your script.

Cisco SG300-52 SNMP ifInOctets Values Unreasonable

The thing is, Cisco is kind of notorious for wrong counters, be it interfaces or other stuff, especially "virtual" interfaces like LAGs. Maybe you're hitting a bug. You could try another IOS version or look for a Cisco bug report for this. You could also open a TAC case to have them look at it.

Also try looking at the counters for the physical member interfaces of the LAG. See if they in sum are correct / divert from the LAG counter.

Best Answer

Related Solutions

Routing – n SNMP MIB for Cisco Track Objects

Cisco SG300-52 SNMP ifInOctets Values Unreasonable

Related Topic