4

When adding new devices to my Cacti instance, I get frequent "SNMP error" messages in the device screen. But the error is not consistent, not even for the same device. Here's what I already have checked:

  • Sometimes a device shows that "SNMP error" message even when it did not had that error an hour before, and vice versa.
  • I tried this with several different Cacti releases, installed on different OS (Debian squeeze: 0.8.7g-1+squeeze1, Debian Sid: 0.8.7i-3, CentOS 6.0: 0.8.7i-2.el6)
  • tried both from a local (192.168.1.xy) network and from a different data center so I don't think it is a network problem
  • reinstalled the Cacti database, rerun the scripts to install my devices. Now different devices have that error
  • when executing a snmpwalk or snmpgetnext command from the command line, it is always successful
  • increasing the timeout to 20000 (20 seconds) and the retry count to 10 does not make a difference

The cacti.log says:

04/14/2012 02:10:19 PM - CMDPHP: Poller[0] WARNING: SNMP GetNext Timeout for Host:'s0026.mydomain.de', and OID:'.1.3.6.1.2.1.1.3.0'
04/14/2012 02:10:20 PM - CMDPHP: Poller[0] WARNING: SNMP GetNext Timeout for Host:'s0026.mydomain.de', and OID:'.1.3'

However, when executing snmpget or snmpget with that from the command line a proper response is returned immediately.

nn4l
  • 1,336
  • 5
  • 23
  • 40
  • Are you running any firewalls on any of the machines that may be detecting this as an attack? – devicenull Apr 16 '12 at 00:56
  • no, there are no firewalls on any of the machines. The OS is a minimal and up-to-date Debian in most cases. – nn4l Apr 16 '12 at 06:47

2 Answers2

1

It sounds almost like a DNS issue- have you used straight IP addressing (1.2.3.4) for your host entries instead of their domain names (justn.example.com)?

danno
  • 758
  • 5
  • 12
1

In Cacti you have 2 pollers. One is the php one (the default one and the one used in your case) and a compiled one. The php poller has a debug option that can be configured in the web interface. You can enable this to obtain more information in the logs.

If you do not find anything else. I would start by monitoring the Cacti server by itself with dstat -ta 10.

Enable network capture and save the capture in a file with sudo dumpcap -pw /tmp/snmp.cap -i eth0 -f "udp port 161 or icmp" then transfer the snmp.cap file to your workstation and analyze it with Wireshark. Look for SNMP requests left without answers.

Mircea Vutcovici
  • 17,619
  • 4
  • 56
  • 83