We have multiple Linux devices being monitored in Spectrum which are generating a lot of High CPU alarms, however when we check the devices the CPU seems to be fine. Now I imagine that Spectrum is using 126.96.36.199.188.8.131.52.3.1.2 (hrPRocessorLoad) which actually only gives the average, over the last minute, of the percentageof time that this processor was not idle. So lets say that the processor is used 2% for the whole of the minute, the load would show as 100 and trip our 85% threshold to create an alarm.
I have also looked at the following OID's:
1 minute Load: .184.108.40.206.4.1.2021.10.1.3.1 5 minute Load: .220.127.116.11.4.1.2021.10.1.3.215 minute Load: .18.104.22.168.4.1.2021.10.1.3.3percentage of user CPU time: .22.214.171.124.4.1.2021.11.9.0 raw user cpu time: .126.96.36.199.4.1.2021.11.50.0 percentages of system CPU time: .188.8.131.52.4.1.2021.11.10.0 raw system cpu time: .184.108.40.206.4.1.2021.11.52.0 percentages of idle CPU time: .220.127.116.11.4.1.2021.11.11.0 raw idle cpu time: .18.104.22.168.4.1.2021.11.53.0 raw nice cpu time: .22.214.171.124.4.1.2021.11.51.0
However none of them give a simple percentage of the CPU usage which would work correctly with attribute redirection for monitoring.
Is there something I'm missing about monitoring Linux systems or is there a way to use the above information to get a simple percentage ?
The device sysobjectid is 126.96.36.199.4.1.8072.3.2.10.
In Spectrum it will depend upon the agent, but Spectrum will use RFC-2790 and/or Net-SNMP, with taking preference of using RFC-2790 for CPU calculations.
RFC2790 CPU utilization is a direct read from hrProcessorLoad/0xc4074a · 188.8.131.52.184.108.40.206.3.1.2
For Net-SNMP we use the following calculation: ssCpuRawUser 220.127.116.11.4.1.2021.11.50ssCpuRawNice 18.104.22.168.4.1.2021.11.51ssCpuRawSystem 22.214.171.124.4.1.2021.11.52ssCpuRawIdle 126.96.36.199.4.1.2021.11.53ssCpuRawWait 188.8.131.52.4.1.2021.11.54ssCpuRawKernel 184.108.40.206.4.1.2021.11.55ssCpuRawInterrupt 220.127.116.11.4.1.2021.11.56ssCpuRawSoftIRQ 18.104.22.168.4.1.2021.11.61 TotalTicks=Delta( C1, 1 ) + Delta ( C2, 2 ) + Delta( C3, 3 ) + Delta( C4, 4 ) + Delta( C5, 5 ) + Delta( C6, 6 ) + Delta( C7, 7 ) + Delta( C8, 8 )
-Where C# is the cached value from initial read and # is the last read. # corresponds to the index numbers above. UsedTicks=TotalTicks - Delta( C4, 4 ) Utilization=( UsedTicks * 100 ) / TotalTicks
If your not happy with RFC-2790, you may try installing Net-SNMP and then changing the Source in Spectrum to use Net-SNMP.
As most of the agents work on RFC-2790 or Net-SNMP, you can either use a Spectrowatch and create your own calculations, use a proprietary agent such as CA Unified Infrastructure Manager (UIM).
I hope this helps.