This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.
You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

Orion shows discards, switch ports do not

We are investigating some discards on one of our Cisco 3750 switches.  Early this AM we were showing identical discard numbers both on the switch interface counters and in Orion, but later this morning Orion showed exactly double the number of errors but the corresponding interface counters did not show any additional discards.  What can cause this?  -Debbi

  • We have the same issue with our 6513 switch where we show receive discards on the port but the switch does not show any errors or problems on the port.

    Where is Orion getting this information from?

  • FormerMember
    0 FormerMember in reply to profzoom1

    We pull Discards and Errors from the standard MIBs:

    ifInDiscards = "1.3.6.1.2.1.2.2.1.13."
    ifInErrors = "1.3.6.1.2.1.2.2.1.14."
    ifOutDiscards = "1.3.6.1.2.1.2.2.1.19."
    ifOutErrors = "1.3.6.1.2.1.2.2.1.20."

  • We have a similar problem with a Cisco 3750-E that is reporting discards on the uplink interface but there are none shown on the interface counters from the command line. Using the SNMP MIBS the discards are showing around 500000 but never increasing. Orion reports these every few hours on the chart and shows several million a day on the interface page which makes it look like new discards are occuring.

    Any ideas what's going on?

  • I would recommend opening a technical support case to further troubleshoot this.

  • I will open a case and if I find out anything helpful I will post it in this thread.

  • I've opened a case so hopefully get this one sorted soon. Will post anything useful I find.

  • Finn, I hope you have more luck than me.  I am finding no particular correlation when I walk the mib on any of my switches with 1.3.6.1.2.1.2.2.1.19 with the number Orion shows, so I am thinking that may not be the correct OID.  And support is now telling me:

    "Now this can be corrected by resetting the counters on the device and then the mib will report "0". This should reset the counter on the website as well"

    As you know, you can clear counters on an interface, but the value for that OID will not clear until the box is rebooted.  So they are telling me basically every time I see any discards increment on any of my thousands of interfaces, to quickly log in to the box and "clear the counters".

    I guess I need an explanation of how orion picks up this hour's or this day's errors and discards.  I am only guessing, but perhaps it takes an initial reading of the OID, then as the day goes by, as it polls the OID again, it subtracts the previous reading from the current and reports that number.  Is that right?

    If so, there is something broken with Orion's interaction with this switch.  These ports had discards a week ago one time.  Since then, Orion has been re-reading the same OID result and adding it to itself several times during every day.

    Debbi

  • I suspect these counters may be incrementing from discards due to Vlan mismatches/dropped packets.

  • The discards aren't incrementing on the switch via the mib counters or the interface counters. What we've found so far is that Orion isn't getting the correct value every time it queries the switch, most the time it's gettting zero instead of the correct value (circa 500k) so when it ramdonly does get the correct value it thinks it's an increment.

    We're investigating errors with the database at the moment that may be the root of the problem.

  • After working extensively with Orion tech, and doing a wireshark capture, we found that the switch itself was returning incorrect data.  It would show, say, 4000 as the value, then once in a while (several times a day) the same OID would show 8000, then it would bounce back to 4000.  I am sure this confused Orion.  We verified this with a separate snmpget program that we ran continuously.  It showed the same thing.  We have opened a TAC case with Cisco. Our switch is a 3750 running 12.2(40)SE.  -Debbi