This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.
You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

False Positive Alerts on Interface Errors

Solarwinds is periodically reporting there are suddenly thousands or hundreds of thousands of errors on an interface. This is happening on multiple devices. It's as if Solarwinds is forgetting or losing the interface error count then when the next poll happens it reports the number of errors since the device was last rebooted (which for some devices is years).

The attachment is of a particular device that had false alerts several days in a row. Every one of those is the same number of errors, the errors aren't incrementing. Now, I know Solarwinds pulls the mib values, and I have done a snmp walk and checked that the interface error counts in the mib match what Solarwinds is reporting. So, that's accurate at least.

Why is this happening? And more so, what can I do to stop, correct, or avoid this?

  • I would check the device polling. If using 64 bit counters you will need the option checked on the node, but also will need to use Counter Rollover Method 2. If your rollover is Method 1, then your #'s are 'calculated' 

     Method 1 = (MaxValue - LastPolledValue) + CurrentPolledValue

    Method 2, the value is discarded on rollover and a new sample is taken within 20 seconds.

     - I would also confirm the details by using the two widgets, Top XX Interface Errors this Hour & Top XX Interface Errors Today.

    These will allow a filter on interface type details(Interfacetype, Interfacetypename & Interfacetypedescription) and any other node details you need to narrow in on to find your offending interfaces.

     - CharlesH

  • , where do you change the counter rollover method?

  • Settings - All Settings - Polling Settings -

    Just a little more than 1/2 way down, you'll find the "CALCULATIONS & THRESHOLDS" section, below Network and above Hardware Health Polling.

    rollover.png