Interface goes in to an "Unknown" state

Question

I have been having issues with interfaces on Windows servers going in to an “unknown” state for no apparent reason.  I have not found any reason for this when looking at the monitored server or Orion server event logs.  There were no system reboots and no service failures.  The device shows as up but since the interface is in an unknown state no snmp stats are collected.  Restarting the SNMP service resolved the problem but you then end up with a gap in the snmp stats.

I opened a case with customer support and was told that this is a common problem with Microsoft SNMP and that I should uninstall and re-install SNMP on my servers or switch to a 3rd party snmp agent.  These do not seem like good answers to me since I am currently monitoring more then 100 windows servers and have not had issues with the window SNMP agent before.

Has anyone else seen this behavior and found a suitable fix?

FormerMember · Answer

I now understand that you are not a Solarwinds employee and that you for the info and advice.
We are going to open a case with MS as well.
Thanks

aLTeReGo · Answer

Perhaps I should clarify something. I am not employed by, affiliated with or associated to SolarWinds or SolarWinds Technical Support in any way. The views expressed in my posts are not necessarily those of SolarWinds or SolarWinds technical support staff. I am simply a long time knowledgeable customer who makes every attempt possible to help others like yourself solve problems associated to Orion and other SolarWinds products.

I understand your frustration and my post was in no way meant as a brush off. My posting was not random. In fact I've had the exact same problem you are dealing with now. I contacted Microsoft Technical Support at the recommendation of SolarWinds technical support and worked a case for a few days troubleshooting the issue. Unfortunately the reason that very few of the postings in this forum seem similar is because the problem is unique to each customers environment. For instance I had three servers that exhibited this problem and were built from a hardened server image. The problem was ultimately traced to a problem in the master image. On another pair of servers the problem was traced to a 3rd party trap MIB.

What i am trying to say is I do not believe that it is the responsibility of SolarWinds to troubleshoot your Microsoft SNMP daemon. The reality is the problem is not with SolarWinds as I proved to myself when I used tools such as NET-SNMP, and Cacti to troubleshoot my problems. If the problem is reproducible with MRTG, CACTI, HP OpenView, ipMonitor, WhatsUp Gold, etc etc then the problem clearly is not with SolarWinds but with Microsoft. If the problem is confined to SolarWinds then I would strongly encourage you to open a technical support case with them. It will only serve to make the product better in the long term. However I do think you'll find the problem is universally tied to the Microsoft SNMP daemon. At which point you should contact Microsoft technical support to continue to troubleshoot the problem further. Microsoft support is fantastic and second only to Cisco in my opinion.

Good luck.

ceclark · Answer

I get this with Cisco equipment....