several interfaces are showing in an unknown state on my router

Krfitzgerald,

The ifIndex of the interfaces in IF-MIB has changed. This happens to some Cisco devices where you will have to set the ifIndex to persist: http://www.cisco.com/en/US/tech/tk648/tk362/technologies_tech_note09186a0080134eec.shtml

You might try to run snmpwalk against the Cisco device and try to match it with the Interface Details view to tally if the ifIndex of that interface is the same as in the snmpwalk results.

The following is the KB to do a snmpwalk: http://knowledgebase.solarwinds.com/kb/questions/3145/

The following Cisco SNMP Object Navigator result search for ifIndex will give you a good idea of the OIDs that you should be looking from the snmpwalk results: http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?local=en&translate=Translate&objectInput=ifIndex

HTH.

Try Edit Node > "Uncheck" 64 bit counter " and Uncheck " Topology Layer 3 " Topology Layer 2 "  from List Resources.

You can check the device support for the 64 bit counters as below oid after running the Mib Walk .

SolarWinds Knowledge Base :: What object IDs (OIDs) does Orion NPM poll for interface information? What types of interface information does Orion NPM poll?

List resources will reflect the current state of things as received from device. Are you able to delete the Unknown interface using the Node Management page?

This was noticed today in my environment. What complicated it is that I upgraded NPM and NCM last week, so I wasn't sure if this was the cause. Though it was initially thought to be, I found that it did not occur on all routers, just a few. I also found that these routers were updated about a month ago, and I am wondering if the interface data has been incorrect since then.

In my example, I was notified that a router's interfaces are listed in an Unknown state and showing no statistic data. When I go into Edit mode on the node and test the SNMP string, it tests good. It is when I go into List Resources that it gets a bit strange. When I bring up the interfaces during List Resources, the two interfaces that are Unknown (Serial -0 and Fast Ethernet -0) don't even show up there. Several others there were green, and I chose four of them. When I saved my choices, the Serial -0 was still a listed interface, in an Unknown state, but Fast Ethernet -0 was gone and there was an entry on the node's event summary that the interface was removed.

So now it looks like I am stuck with the Serial -0. I can't see it under List Resources to remove it, and adding the others placed them alongside it but didn't remove it. I have tried a rediscovery and a poll, but this did nothing. In looking at the link for the ifIndex persistence, it sounds very similar to what might have happened. I am going to refer that link to our network guys so they can check, but I am not sure what to do to fix in monitoring. Right now I checked about 6 routers, and 2 show up this way, so I am going to need to check all of our routers, but I would like to know how to fix it. I haven't yet tried deleting the device and adding it back in, but that might be my next step, though I am reluctant to do that.

Anyone have any new information on this? Could the upgrade to NPM and NCM possibly have caused this, or do you think it was just coincidence as to when it was noticed? Any information would be appreciated.

I would first ask your network guys about did they make any change, upgrade on those devices. By design NPM does not recognize and poll volumes ifter their name on the server side was changed. The only way to fix it is to remove and add again the affected volumes, interfaces. Could be the same with the interfaces as well.

Thanks for the quick reply. I removed the device and added it back in, and the issue cleared right up. I queried the db, and found only a few other routers with this issue, all routers that I have confirmed were updated recently. So, this looks to be something with the router config, as suspected. I am waiting to hear back from our network guys. The issue is compounded by the fact that we have ATT managed routers, so we actually have to check with them.

In the meantime, I am going to remove/add the few routers where this is occurring.

You don't need to remove whole device (and lose historical data) to clear this up. As I mentioned earlier, List resources shows the interfaces it gets from device at that moment. So it's not the place to go to delete a no-longer-existing interface. You can delete it in Node Management page.

In general, if you see an Unknown interface while others have proper statuses:

1. Check its Interface details page. Absence of historical data in there mean it may no longer exist (i.e. was removed from device, or renamed in such way NPM is unable to fix automatically)

2. Open list resources of that node. If the interface doesn't show there, the assumption is correct and the interface data no longer come from device

3. Check with your network guy if the change is permanent and the interface can be removed from NPM (if the interface is added back to device later, NPM may be able to pick it up and continue polling unless the name changes).

4. To remove the interface from NPM, go to Settings -> Manage nodes and delete the interface there

Thanks this helped me resolve my issue.

I've recently run into this issue as well.  While this is good advice for someone with a small network, there's got to be a way to do this in mass rather than clicking on each individual device looking for these ghost interfaces.  I have around 2K nodes and it's going to be a pain in the ass if I have to go through each one looking to see if this is applicable and then deleting them.

I know I got this from a Thwack article some time ago, but I don't have the link to it.  It uses a query you can put in a resource.

SELECT I.InterfaceName, N.Caption, N.DetailsURL AS [_LinkFor_Caption]

FROM Orion.NPM.Interfaces I INNER JOIN Orion.Nodes N ON (N.NodeID = I.NodeID)

WHERE I.Status = 0

I also built a custom report to do the same thing.  Then I can go through and deal with them.  I always run a list resources on the nodes these interfaces are found on in case it was a hardware change I wasn't informed of and new interfaces of interest exist on the new device.