This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.

You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

Interface unknown events not clearing

ShadowLawz over 13 years ago

We are experiencing quite a few interface unknown's for multiple devices and device types. The last part of each of the unknown message states "Interface Polling stopped. Could not remap interface. Check ifDescription change." The majority of these alerts are from Windows 2003 and 2008 r2 servers Packet Scheduler Miniports and VMware NIC's. There are only a few alerts related to a Cisco router/switch. There haven't been changes to our SNMP configuration, nor have any of the devices changed. I have tried rediscovering the device and the NIC in question but nothing changes. We haven't restarted the SNMP services on the servers b/c we don't want to chance hanging up the server and forcing a reboot. Has anyone else had this issue or have any suggestions on how to fix it? Thanks in advance for any help you all can give. PJ

0 William_Powley over 13 years ago

Shadow,
I'm also seeing this, and am still zeroing in on the problem but thought I'd throw this out there in case it help at all.
Windows Server 2003 R2 server
Interfaces were up and running, but I was seeing the unknown events message as you were. I tried listing resources and couldn't get a response from the server. I already knew the server was very saturated, and tried narrowing down why, but wasn't seeing anything performance wise or in the logs that indicated what was going on. I stepped back to a couple of other servers I was seeing errors on, domain controllers, and found that the DNS server wasn't running on them for some reason. Once I started this, a majority of my alerts went away (go figure), and then so did the blinking grey box in NPM.
Again, I'm not sure how helpful this will be, but hopefully it will help in someway. Maybe a service, or something else that that server interacts with is causing a strange interface behavior that NPM is picking up on but doesn't know how to describe to us.
I'd be interested in any feedback you have on this, as it might help me narrow down what I'm seeing as well. I'll post more if I find out anything else...good luck.
William
Cancel
Vote Up 0 Vote Down

Cancel
0 ShadowLawz over 13 years ago in reply to William_Powley

The majority of these events are coming from virtual NIC's so I am wondering if it's not an issue with the way NPM collects SNMP data from r2 servers. It could also be the way the r2 sends SNMP data too. I am going to see if I can restart the service on one of the less critical servers this morning in hopes it will fix the issue. Thanks for the suggestions, William!!!

Any other thoughts are appreciated too. Keep them coming....
Cancel
Vote Up 0 Vote Down

Cancel
0 shaggyva over 13 years ago

Yes, I have been seeing tons of these specific interface events, which all appear to have started on Thursday, July 22 early morning... primarily with our Meru Wireless controllers.
I am going to check and see if any Microsoft Updates/Patches were applied to my Orion server on or near that date/time. Just a hunch right now.
Here is the actual event:
"<Node name-eth0-> Interface Polling stopped. Could not remap interface. Check ifDescription change."
Cancel
Vote Up 0 Vote Down

Cancel
0 ShadowLawz over 13 years ago in reply to shaggyva

I didn't get a chance to restart the SNMP agents on any servers this morning, I will in the morning as long as we don't end up busy again. Thanks for the reply shaggyva!
Cancel
Vote Up 0 Vote Down

Cancel
0 shaggyva over 13 years ago

We restarted the SNMP service running on each Meru Wireless controllers and that appears to have fixed our issues. Still unsure as to why they all started acting up in the first place though. Hope that helps.
Cancel
Vote Up 0 Vote Down

Cancel