We are encountering following problem once a day.
We have a Cisco 6500 Core Switch running and 87 Cisco workgroup switches.
After a fresh Installation of Solarwinds NPM 12 we receive over 2500 trap messages with following text from our core switch:
sysUpTime = 341 days 0 hours 39 minutes 20,24 seconds
snmpTrapOID = CISCO-SYSLOG-MIB:clogMessageGenerated
clogHistFacility.439231 = SNMP
clogHistSeverity.439231 = 4
clogHistMsgName.439231 = INPUT_QFULL_ERR
clogHistMsgText.439231 = Packet dropped due to input queue full
clogHistTimestamp.439231 = 2946476024
The messages appear every 24 hours and 15 minutes.
I wonder why the messages arrive once a day, not after each polling routine.
We changed SNMP to V1 to avoid bulk requests, but no success.
There are no other Solarwinds products installed, so NPM definetely causes the trap messages.
Is there a job or polling routine that runs once a day against the core switch in the mentioned rythm??
I checked the logfiles, but i cannot find a hint what´s going on.
Maybe you can help me finding the problem...
Thanks in advance and greetings from Germany!
It is a known snmp response issue.
We are seeing it on our 3850, Sup2's on the 4500's..
It may be to the size of the response packets.
It does not appear that a fix is coming, putting the snmp filter in place will help clean up syslog, and also require us to reconsider our strategy how we use UDT and NCM jobs for inventory.
As I believe both hit these MIBs every poll cycle.
%SNMP-3-INPUT_QFULL_ERR when polling the CISCO-SWITCH-ENGINE-MIB
|Known Affected Releases:|
|Known Fixed Releases:|
Following on from this, i would suggest trying to remove 'nightly inventory job' from this device if you have this set up or removing the node from NCM if its configured with this modul. I would remove the device from NCM then check back tomorrow
Btw: Our Core Switch is a VSS system with 2 6500 devices. We read about the FW Bug, and we are planning to perform a FW update on our Cores soon.
Relating to this bug, in my opinion the messages should appear every time the Core Switch is being polled, not only every 24 hrs and 15 Minutes?
So Your idea with the nightly job sounds good to me.
Let´s see if it leads to success 😉
I will spend a coffee then!
Well... no success. The traps messages are back, exactly 24hrs and 15 minutes after the last messages from yesterday.
Maybe there´s a general problem with Solarwinds Orion NPM and Cisco VSS?
Done a quick browse been abit tided up today
check this link out the Second one seems more legit
i actually think this is the solution at the moment for you seems to meet everything you've mentioned
Thanks, we tested everything, SNMPv1, all pollers off...Nothing was helpful.
The Solarwinds support told us to ask Cisco because it is a Cisco problem. Cisco told us to ask Solarwinds...
Well, we will perform the Cisco FW upgrade and then we´ll see if the problem disappears or not.
Thanks for your help!!!
SolarWinds solutions are rooted in our deep connection to our user base in the THWACK® online community. More than 150,000 members are here to solve problems, share technology and best practices, and directly contribute to our product development process. Learn more today by joining now.