5 Replies Latest reply on Jul 28, 2010 5:20 PM by shaggyva

    Interface unknown events not clearing

    ShadowLawz

      We are experiencing quite a few interface unknown's for multiple devices and device types.  The last part of each of the unknown message states "Interface  Polling stopped.  Could not remap interface.  Check ifDescription  change."  The majority of these alerts are from Windows 2003 and 2008 r2 servers Packet Scheduler Miniports and VMware NIC's.  There are only a few alerts related to a Cisco router/switch.    There haven't been changes to our SNMP configuration, nor have any of the devices changed.  I have tried rediscovering the device and the NIC in question but nothing changes.  We haven't restarted the SNMP services on the servers b/c we don't want to chance hanging up the server and forcing a reboot.  Has anyone else had this issue or have any suggestions on how to fix it?  Thanks in advance for any help you all can give.  PJ

        • Re: Interface unknown events not clearing
          William_Powley

          Shadow,

          I'm also seeing this, and am still zeroing in on the problem but thought I'd throw this out there in case it help at all.

          Windows Server 2003 R2 server

          Interfaces were up and running, but I was seeing the unknown events message as you were.  I tried listing resources and couldn't get a response from the server.  I already knew the server was very saturated, and tried narrowing down why, but wasn't seeing anything performance wise or in the logs that indicated what was going on.  I stepped back to a couple of other servers I was seeing errors on, domain controllers, and found that the DNS server wasn't running on them for some reason.  Once I started this, a majority of my alerts went away (go figure), and then so did the blinking grey box in NPM.

          Again, I'm not sure how helpful this will be, but hopefully it will help in someway.  Maybe a service, or something else that that server interacts with is causing a strange interface behavior that NPM is picking up on but doesn't know how to describe to us.

          I'd be interested in any feedback you have on this, as it might help me narrow down what I'm seeing as well.  I'll post more if I find out anything else...good luck.

          William

            • Re: Interface unknown events not clearing
              ShadowLawz

              The majority of these events are coming from virtual NIC's so I am wondering if it's not an issue with the way NPM collects SNMP data from r2 servers.  It could also be the way the r2 sends SNMP data too.  I am going to see if I can restart the service on one of the less critical servers this morning in hopes it will fix the issue.  Thanks for the suggestions, William!!!

               

              Any other thoughts are appreciated too.  Keep them coming....

            • Re: Interface unknown events not clearing
              shaggyva

              Yes, I have been seeing tons of these specific interface events, which all appear to have started on Thursday, July 22 early morning... primarily with our Meru Wireless controllers. 

              I am going to check and see if any Microsoft Updates/Patches were applied to my Orion server on or near that date/time.  Just a hunch right now.

              Here is the actual event:

              "<Node name-eth0-> Interface Polling stopped. Could not remap interface. Check ifDescription change."

              • Re: Interface unknown events not clearing
                shaggyva

                We restarted the SNMP service running on each Meru Wireless controllers and that appears to have fixed our issues.  Still unsure as to why they all started acting up in the first place though.  Hope that helps.