cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

This community is for technical, feature, configuration and deployment questions.
For production deployment issues, please contact the TAC! We will not comment or assist with your TAC case in these forums.
Please see How to Ask the Community for Help for other best practices.

1882
Views
6
Helpful
5
Replies
Arne Bier
VIP Advisor

ISE SNMP Trap - dskThresholdLimit - what is the OID?

Hi

I have two MNT nodes with 1.2TB HDD's - it's a new deployment and currently I am unlikely to have any disk capacity issues.  But I wanted to set up the one and only SNMP Trap that ISE offers.  We use PRTG and there is a Probe that listens for SNMP Traps - the issue I have is that I am unable to see the OID that relates to this trap below - I need the exact OID for the PRTG filter to react correctly.

I could not find anything useful in the ISE documentation - ACS documentation mentions dskThresholdLimit (

.iso.org.dod.internet.private.enterprises.ucdavis.dskTable.dskEntry.dskPath ) - I did a Google search and found

1.3.6.1.4.1.2021.9.1.9 (http://oidref.com/1.3.6.1.4.1.2021.9.1.9)

Below is what I have configured on my MNT node

snmp-server trap dskThresholdLimit "1"

snmp-server host snmp-host-123 version 2c public

I applied the config above and analysed in Wireshark. ISE sent me a few Link Down/Up and uptime traps etc. Wasn't expecting those.  And I didn't see anything to do with disk space. 

It appears as if I am already over the 1% usage threshold, so I should get a trap?

What am I doing wrong ?

sco8834ise050/admin#   show disks

disk repository: 2% used (203644 of 14987616)

Internal filesystems:
/ : 16% used ( 2135924 of 14987616)
/dev : 0% used ( 0 of 32895148)
/dev/shm : 0% used ( 0 of 32905156)
/run : 1% used ( 768 of 32905156)
/sys/fs/cgroup : 0% used ( 0 of 32905156)
/tmp : 1% used ( 6556 of 1983056)
/boot : 23% used ( 103749 of 487634)
/storedconfig : 2% used ( 1582 of 95054)
/opt : 3% used ( 31054032 of 1212603984)
/run/user/440 : 0% used ( 0 of 6581032)
/run/user/301 : 0% used ( 0 of 6581032)
/run/user/321 : 0% used ( 0 of 6581032)
/run/user/0 : 0% used ( 0 of 6581032)
/run/user/304 : 0% used ( 0 of 6581032)
/run/user/303 : 0% used ( 0 of 6581032)
  all internal filesystems have sufficient free space

ISE 2.2p1

1 ACCEPTED SOLUTION

Accepted Solutions
hslai
Cisco Employee

I learned today that the trap is done through a scheduled job running every 5 minutes.

And, what you defined is the reverse.

snmp-server trap dskThresholdLimit shows,

snmp-server trap dskThresholdLimit value

Syntax Description

value

Number that represents the percentage of available disk space. The value ranges from 1 to 100.


So, you would use something like 99 as the value instead of 1.

View solution in original post

5 REPLIES 5
hslai
Cisco Employee

It's a known issue that disk check not enabled in recent releases.

CSCve86955 is the bug ID. I just updated it so it will take ~ 24 hours before external visible.

hslai
Cisco Employee

I learned today that the trap is done through a scheduled job running every 5 minutes.

And, what you defined is the reverse.

snmp-server trap dskThresholdLimit shows,

snmp-server trap dskThresholdLimit value

Syntax Description

value

Number that represents the percentage of available disk space. The value ranges from 1 to 100.


So, you would use something like 99 as the value instead of 1.

View solution in original post

Thanks - that made a difference.  The mystery is solved.

I wanted to provoke the trap to find the OID (it helps to know that ISE uses the Net-SNMP suite - in that case I managed to find the complete listing at Net-SNMP) - and they define "dskPercent" as 'Percentage of space used on disk'.  This is how I expected it to work - makes more intuitive sense - if you want an SNMP trap to be sent when a volume is 10% used, then the value should be 10.  The word "limit" implies an upper value .. as opposed to the concept of a remaining value, which is how ACS/ISE has chosen to implement this.  Unnecessarily confusing - and as you can see, the SNMP trap contains the actual disk percentage used, and not its remaining value.   What does CSCve86955 actually resolve?

On my MNT node I set

snmp-server trap dskThresholdLimit "99"

And with the disk output below I got the SNMP traps seen further below

sco8834ise050/admin# show disk

disk repository: 2% used (203644 of 14987616)

Internal filesystems:
/ : 16% used ( 2132304 of 14987616)
/dev : 0% used ( 0 of 32895148)
/dev/shm : 0% used ( 0 of 32905156)
/run : 1% used ( 796 of 32905156)
/sys/fs/cgroup : 0% used ( 0 of 32905156)
/tmp : 1% used ( 6544 of 1983056)
/boot : 23% used ( 103749 of 487634)
/storedconfig : 2% used ( 1582 of 95054)
/opt : 3% used ( 31205296 of 1212603984)
/run/user/440 : 0% used ( 0 of 6581032)
/run/user/301 : 0% used ( 0 of 6581032)
/run/user/321 : 0% used ( 0 of 6581032)
/run/user/0 : 0% used ( 0 of 6581032)
/run/user/304 : 0% used ( 0 of 6581032)
/run/user/303 : 0% used ( 0 of 6581032)
  all internal filesystems have sufficient free space

1.3.6.1.4.1.2021.9.1.2 contains the filesystem name (e.g. "/", "/tmp")

1.3.6.1.4.1.2021.9.1.9 contains the % used as seen in the show disk above

CSCve86955 is about the OID not available for SNMP GET in ISE 2.0.1+. And, if we manually define it in the snmpd.conf file and restart the daemon, the values are 2% lower than what we obtain from "df" command.

Arne Bier
VIP Advisor

Success!  My PRTG now shows the disk space warnings in regular 5 minute intervals.  I only classified these two OID's at Warning level.

PRTG-Graph for disk space warning SNMP Trap.png

Content for Community-Ad