10.4 False Positive Alerts Interfaces errors etc

dpatzold1979

alertsThis is the 3rd time since upgrading to 10.4 that we have gotten an alert on interfaces with output errors that didnt happen.

Has anyone else seen or getting false positive alerts since upgrading?

i upgraded from 10.2.2 to 10.4 and previously i have never gotten a false positive.

I cleared the interface counters 5 days ago but orion reported errors on the interface today and the switch does not show any errors on the interface.

is it possible for stats to be stuck in the database and being alerted on?

Find more posts tagged with

errors

false

positive

Alerts

Accepted answers

All comments

PavelSuchy

Hi dpatzold1979,

This will need some investigation and I am affraid we won't be able to provide you satisfying answer according your description only. So I can only suggest you to create a support ticked and attach diagnostics from the environment where this happend. Also mention date,time and interface ID of affected interfaces, please.

Thanks,

Pavel

GoldTipu

Orion pull Errors from following standard MIBs:

ifInErrors = "1.3.6.1.2.1.2.2.1.14."

ifOutErrors = "1.3.6.1.2.1.2.2.1.20."

Since these MIBs are Counters that Increment, Orion takes the Delta of the Difference of 2 Polls to get the Number of Errors .

Can you simply run MIB Walk output from one of the Node in Question and find out yourself as below.

MIB Walk Tool

http://downloads.solarwinds.com/solarwinds/Release/PreRelease/SolarWindsSnmpWalk.zip

Here is MIB Walk result form one of the node reported ERRORS with interface .

ifInErrors = "1.3.6.1.2.1.2.2.1.14."

.1.3.6.1.2.1.2.2.1.14.369098854 = Counter32: 3262

.1.3.6.1.2.1.2.2.1.14.436297728 = Counter32: 3262

.1.3.6.1.2.1.2.2.1.14.526911360 = Counter32: 1

.1.3.6.1.2.1.2.2.1.14.527040832 = Counter32: 65059

.1.3.6.1.2.1.2.2.1.14.527435904 = Counter32: 1

ifOutErrors = "1.3.6.1.2.1.2.2.1.20."

.1.3.6.1.2.1.2.2.1.20.369098854 = Counter32: 243

.1.3.6.1.2.1.2.2.1.20.369098856 = Counter32: 15

.1.3.6.1.2.1.2.2.1.20.369098858 = Counter32: 15

.1.3.6.1.2.1.2.2.1.20.369098860 = Counter32: 15

.1.3.6.1.2.1.2.2.1.20.369098864 = Counter32: 15

.1.3.6.1.2.1.2.2.1.20.369098960 = Counter32: 2923

.1.3.6.1.2.1.2.2.1.20.436215808 = Counter32: 15

.1.3.6.1.2.1.2.2.1.20.436248576 = Counter32: 15

.1.3.6.1.2.1.2.2.1.20.436264960 = Counter32: 15

.1.3.6.1.2.1.2.2.1.20.436281344 = Counter32: 15

.1.3.6.1.2.1.2.2.1.20.436289536 = Counter32: 56

.1.3.6.1.2.1.2.2.1.20.436293632 = Counter32: 106

.1.3.6.1.2.1.2.2.1.20.436297728 = Counter32: 42

.1.3.6.1.2.1.2.2.1.20.436301824 = Counter32: 39

.1.3.6.1.2.1.2.2.1.20.436322304 = Counter32: 296

.1.3.6.1.2.1.2.2.1.20.436326400 = Counter32: 554

.1.3.6.1.2.1.2.2.1.20.436330496 = Counter32: 1620

.1.3.6.1.2.1.2.2.1.20.526779904 = Counter32: 131

.1.3.6.1.2.1.2.2.1.20.526779968 = Counter32: 48

.1.3.6.1.2.1.2.2.1.20.526781120 = Counter32: 0

.1.3.6.1.2.1.2.2.1.20.526781184 = Counter32: 1

.1.3.6.1.2.1.2.2.1.20.526909568 = Counter32: 14

.1.3.6.1.2.1.2.2.1.20.526911232 = Counter32: 14

.1.3.6.1.2.1.2.2.1.20.527041408 = Counter32: 14

.1.3.6.1.2.1.2.2.1.20.527041472 = Counter32: 14

.1.3.6.1.2.1.2.2.1.20.527041664 = Counter32: 14

.1.3.6.1.2.1.2.2.1.20.527041792 = Counter32: 14

.1.3.6.1.2.1.2.2.1.20.527041856 = Counter32: 14

.1.3.6.1.2.1.2.2.1.20.527042176 = Counter32: 14

.1.3.6.1.2.1.2.2.1.20.527173376 = Counter32: 14

.1.3.6.1.2.1.2.2.1.20.527173440 = Counter32: 14

.1.3.6.1.2.1.2.2.1.20.527434944 = Counter32: 14

.1.3.6.1.2.1.2.2.1.20.527436736 = Counter32: 14

One very important thing to understand is that there's a world of difference between discards and errors. Errors indicate packets that were received but couldn't be processed because there was a problem with the packet. In most cases, when you're seeing inbound errors on a router interface the issue is upstream of that device. Could be a bad cable, misconfiguration on one end or the other, or etc. In most cases, these issues are resolved outside of the router where you're seeing the errors. Errors reporting is documented within RFC 1213 (among others including RFC 1573) and typically is pulled from the IF-MIB (ifInErros and ifOutErrors).

you can ignore the Error collection by Unchecking the option " Interface Errors Statistics " under interface.

int errr.jpg

let me know if this helped to address your question ?

dpatzold1979

Thank you for the response. These interfaces in question have HAD errors at one point in time. but have not been incrementing since the upgrade to 10.4 there must be another problem. Please see the image below it shows the dates and times of the interface 1/29 with the same amount of errors as the mib walk performed. They have not been incrementing thus should not trigger an alert Please look at the interface index to compare.

Please escalate this as its clearly a problem with orion.