Linux servers keep losing management in Spectrum

[Kurt Meyer]

Hi all,

I have a client running Spectrum 9.4.2.1, and the Linux servers keep on losing management (SNMP) on Spectrum

The initial discovery is fine, but a day later the devices are unreachable via SNMP.

They are running GroupWise on their systems.

Anybody got an idea why the servers keep dropping SNMP, and what can be done to resolve it?

Regards

Kurt

[Anon Anon]

Hello Kurt,

 

so the alarms come and go away immediately? May be you can try the tcpdump/wireshark command on the spectroserver and check if you see the snmp drops over there.

 

Also check if the snmp req are been sent from spectrum for every 5 minutes (default) to this device. Incase there is no snmp response at all, i would check the ip tables/se linux rules on the linux box along with any firewall access lists between spectrum and device.

[Kurt Meyer]

The SNMP doesn't fail immediately, it takes a day or two before it starts failing. By day 3 all Linux servers have lost management, only ICMP is left.

[Frank Tonjes]

I would check the SNMP agents on the Linux servers (I assume they are running snmpd?). Are they running systemEDGE at all?

Also check the communication between your Spectrum hosts and the servers. If you have the servers offsite at a remote location it could be that the links are heavily used.

I would also check tcpdumps (as recommended above) and make sure there is no underlying network problem.

 

You could also use snmpget from your Spectrum servers and keep a repeating snmpget running every 5 mins and see if that fails too (if you believe it's a Spectrum issue).

[Kurt Meyer]

No, they are not running systemEDGE, and the majority of servers are onsite in their data centre. There are only about 5 that are at branches.

I do not think its an issue in Spectrum, all other servers and devices are being polled correctly. It is only the Linux servers being affected, so I'm going with the issue being on the servers side.

[Anon Anon]

Hello Meyer,

 

In this case if is definitely a server problem or a network issue. I suggest to check this with your network/server team.

[Issac08]

Meyer,

 

  Is the alerts are triggering frequent or for a specific time interval ?if for specific interval means any script running during the time.

What is the os?Whether the alerts are triggering for all Linux servers or specific servers?

IP tables is enabled or disabled?

[Legacy User]

II sounds to me like you have an overlapping discovery. Check your discoveries if you have any. Also you can set the attributes to lock the device type and model type so that prevents that from happening at least it would buy you some time to figure out what is happening. I have had this very thing happen and some times I still do here and there. Look at the creation date is it new or is it old that maybe a clue that they are being deleted and readded as new models..

[MattClausen]

Are the Linux servers running the native Net-SNMP agent or the SystemEDGE SNMP agent?

 

There's a known issue with the SystemEDGE SNMP agent on linux that causes it to hang which is corrected by a later build.

[Kurt Meyer]

Hi Matt, they are not running SystemEDGE, the native SNMP agent is being utilised.

I forwarded information to the client last week, but still waiting for an answer.

[MichaelDavenport62353086]

Any movement on this?  I'm seeing the same issues with modeling linux servers with NET-SNMP