Cacti is a network monitoring/graphing tool using RRDT

Robert V. Bolton | 14 May 2012 20:51

SNMP Query Optimisation Suggestions

Hello fellow Cacti users,

I have a number of switches and routers that I'm graphing traffic in/out,
traffic errors, and cpu utilization on. I'm also using Nagios for high cpu
utilization alerts on these switches and routers as well. I'm receiving a
few alerts for high cpu utilization every so often and I'm trying to tack
down the issue. I know an snmp query against the device will cause the cpu
to spike and I would like to know what is the best way to reduce these
spikes as much as possible. Does anyone have any tips or advice as to what
settings I should use in Cacit to help reduce the cpu spikes do to snmp
queries?

--
*Robert V. Bolton*
Email: robert <at> robertvbolton.com
Web: http://robertvbolton.com
------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/

headers

Gandalf | 14 May 2012 23:35

Re: SNMP Query Optimisation Suggestions

I'm not aware of any throttling mechanism. In fact, we try to fire as many
requests as possible against our targets to be able to poll more items within a
given time. Sp, personally, I'm not aware of any workaround
Reinhard

On 14.05.2012 20:51, Robert V. Bolton wrote:
> Hello fellow Cacti users,
> 
> I have a number of switches and routers that I'm graphing traffic in/out,
> traffic errors, and cpu utilization on. I'm also using Nagios for high cpu
> utilization alerts on these switches and routers as well. I'm receiving a
> few alerts for high cpu utilization every so often and I'm trying to tack
> down the issue. I know an snmp query against the device will cause the cpu
> to spike and I would like to know what is the best way to reduce these
> spikes as much as possible. Does anyone have any tips or advice as to what
> settings I should use in Cacit to help reduce the cpu spikes do to snmp
> queries?
> 
> --
> *Robert V. Bolton*
> Email: robert <at> robertvbolton.com
> Web: http://robertvbolton.com
> ------------------------------------------------------------------------------
> Live Security Virtual Conference
> Exclusive live event will cover all the ways today's security and 
> threat landscape has changed and how IT managers can respond. Discussions 
> will include endpoint security, mobile security and the latest in malware 
> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> _______________________________________________
> cacti-user mailing list

(Continue reading)

headers

Kerry Milestone | 21 May 2012 11:37

Re: SNMP Query Optimisation Suggestions

Hello there,

this is perhaps something that the project should maybe look at, as an
additional option to throttle snmp queries for particular hosts.

We have a multitude of switches/routers that we poll.  They are modern, some
stacked with hundreds of ports and in some cases the management CPU is dual core.

However, the switches and routers are designed such that almost all compute is
done on FPGA chips as close to the physical port as possible - and obviously
very good for networking performance.

The functions that are left over, are done on the main CPU.  One such function
is of course SNMP.

We have a couple of monitoring systems and cacti which all use SNMP.  As with
Robert, I have seen the CPU hit 100% which times out queries.  Investigation
pointed to the SNMP process on the switch and mitigation was to stagger the
crons on the various monitoring tools from overlapping.

I do like the shear volume of queries that can be sent with cacti in a single
go, and the threaded polling on cacti is rather good.

As a workaround, it could be possible I guess to use SNMPd in a proxy format and
fire this off through something like twistedsnmp
(http://twistedsnmp.sourceforge.net/) for throttling but I suspect that trying
to buffer UDP will cause more trouble than it's worth.

Regards,
Kerry.

(Continue reading)

headers

Larry Adams | 28 May 2012 13:49

Re: SNMP Query Optimisation Suggestions

MaxOIDs is your throttle.

Sent from my iPad

On May 21, 2012, at 5:37 AM, Kerry Milestone <km4 <at> sanger.ac.uk> wrote:

> Hello there,
> 
> this is perhaps something that the project should maybe look at, as an
> additional option to throttle snmp queries for particular hosts.
> 
> We have a multitude of switches/routers that we poll.  They are modern, some
> stacked with hundreds of ports and in some cases the management CPU is dual core.
> 
> However, the switches and routers are designed such that almost all compute is
> done on FPGA chips as close to the physical port as possible - and obviously
> very good for networking performance.
> 
> The functions that are left over, are done on the main CPU.  One such function
> is of course SNMP.
> 
> We have a couple of monitoring systems and cacti which all use SNMP.  As with
> Robert, I have seen the CPU hit 100% which times out queries.  Investigation
> pointed to the SNMP process on the switch and mitigation was to stagger the
> crons on the various monitoring tools from overlapping.
> 
> 
> I do like the shear volume of queries that can be sent with cacti in a single
> go, and the threaded polling on cacti is rather good.
>

(Continue reading)