C9500-48Y4C Packets currently in SNMP process input queue

[Exonix]

Hello,

we have several C9500-48Y4C, 16.9.4 and monitore them with SNMP. 20 days ago one switch stopped sending reqests to our monitoring tool. After a short research, I found that the SNMP input queue increases as soon as I restart SNMP and refresh the monitoring. Unfortunately, the debug did not show anything. How can I fix it? 

Thank you!

a0-130#sh snmp
Chassis: CAT23XXXXX
94198719 SNMP packets input
    0 Bad SNMP version errors
    9887 Unknown community name
    0 Illegal operation for community name supplied
    0 Encoding errors
    3847698 Number of requested variables
    0 Number of altered variables
    2910201 Get-request PDUs
    936167 Get-next PDUs
    0 Set-request PDUs
    0 Input queue packet drops (Maximum queue size 1000)
94188610 SNMP packets output
    0 Too big errors (Maximum packet size 1500)
    0 No such name errors
    0 Bad values errors
    0 General errors
    94186985 Response PDUs
    0 Trap PDUs
Packets currently in SNMP process input queue: 16
SNMP global trap: disabled

SNMP logging: disabled

[Giuseppe Larosa]

Hello @Exonix ,

this is likely a SW bug.

In the past I have seen the same issue on Catalyst 3650 or 3850.

post a show version of the affected switch to help in doing a bug search,

Hope to help

Giuseppe

[Exonix]

Hello @Giuseppe Larosa,

yes, it looks like. We found this article CSCvr98368 , but the commands are not complete:

(config)#Snmp-server view entSensor excluded
% Incomplete command.

(config)#Snmp-server view entSensor excluded ?
excluded MIB family is excluded from the view
included MIB family is included in the view

It seems I have to enter something between "view entSensor", but what?

Thank you!

[Giuseppe Larosa]

Hello @Exonix ,

when you define an SNMP view you provide a name for the view

so try the following:

snmp-server view TEST excluded entSensor

snmp-server view TEST included iso

snmp-server view TEST RO

snmp-server view TEST RW

if you can also use the SNMP MIB navigator to locate a MIB.

Note : here entSensor is the name of the MIB to be excluded not the name of the view, the config example provided in the bug page is wrong !

Hope to help

Giuseppe

[Exonix]

Hello @Giuseppe Larosa  the lst command didn't work:

(config)#snmp-server view OMD iso included
(config)#snmp-server view OMD entSensorType excluded
(config)#snmp-server view OMD RO
% Incomplete command.

(config)#snmp-server view OMD ?
  WORD  MIB view family name

[Giuseppe Larosa]

Hello @Exonix ,

forget about the last command but consider the view a sort of ACL order of commands is very important

I would use

snmp-server view OMD entSensorType excluded

snmp-server view OMD iso included

if you think at how the OID trees are built iso is much more near the root of OID tree.

Hope to help

Giuseppe

[Exonix]

Hello @Giuseppe Larosa 

I tried both orders - the result is always the same:

#sh snmp view
OMD iso - included nonvolatile active
OMD entSensorType - excluded nonvolatile active
cac_view pimMIB - included read-only active
cac_view msdpMIB - included read-only active

maybe it's all about nonvolatile ? Other options are "read-only"

[Giuseppe Larosa]

Hello @Exonix ,

I think it is fine now as SNMP view definition , do you see any improvement in the switch ?

What is important is to filter = exclude the offending MIB, in this way the switch will not try to answer to variabled in the MIB that is filtered.

Hope to help

Giuseppe

[Exonix]

unfortunately, there are no improvements. Apparently, I need to find the offending MIB. But how to find?

[Exonix]

@Giuseppe Larosa I've disabled entire hive - didn't help:

sh snmp view
OMD iso - included nonvolatile active
OMD ciscoEntitySensorMIB - excluded nonvolatile active

[Giuseppe Larosa · Accepted solution]

Hello @Exonix ,

if the SNMP view does not help your only option is an IOS XE upgrade.

Hope to help

Giuseppe

[Exonix]

firmware upgrade has helped

[marce1000]

         - FYI : https://bst.cloudapps.cisco.com/bugsearch/bug/CSCuz93302

 M.

[Exonix]

Hello @marce1000 ,

restart helps, but only for a few seconds.

[marce1000]

 - You may have a go with the current advisory release :

            https://software.cisco.com/download/home/286319589/type/282046477/release/Amsterdam-17.3.3?catid=268438038

                                                                        check if that can help 

  M.