Unable to view individual switch interfaces. Is this a tag misconfiguration?

, , ,
1

I’ve had to make a recent change to my Telegraf collector, to reduce the SNMP load on a new switch, as its ifXTable was returning data for over 200 virtual interfaces (on a 24 port switch) hammering the CPU.

With the below configuration, I can get switch traffic into InfluxDB, while dropping the virtual interfaces from being saved.

However, I’m only able to retrieve data if I do not specify an interface.

I suspect that it’s because I’ve enabled ifName as a tag (see config at the end of this post), but I can’t get it to work with or without it. Can anyone please shed some light on what I’m doing wrong?

AllInterfaces
AllInterfaces1511×761 160 KB

SELECT derivative(mean("ifHCInOctets"), 1s) /1000000*8 AS "In", derivative(mean("ifHCOutOctets"), 1s) /1000000 *-8 AS "Out" FROM "snmp" WHERE ("hostname" = 'Server-Room-C-POE') AND $timeFilter GROUP BY time($interval), "ifName" fill(null)

vs specifying an ‘ifName’ interface in the the following query returns no data.

SELECT derivative(mean("ifHCInOctets"), 1s)  / 1000000 *8 AS "Down", derivative(mean("ifHCOutOctets"), 1s)  / 1000000 *-8 AS "Up" FROM "snmp" WHERE ("hostname" = 'Server-Room-C-POE' AND "ifName" = 'gi1/0/1') AND $timeFilter GROUP BY time($__interval) fill(null)

Here’s the relevant snmp collector section in my telegraf agent

## measurement name
name = "snmp"

[[inputs.snmp.field]]
  name = "hostname"
  oid = "RFC1213-MIB::sysName.0"
  is_tag = true

[[inputs.snmp.table]]
  name = "snmp"
  inherit_tags = [ "hostname" ]
# Not collecting the below table as switch returns 4000+ rows due to unneeded virtual interfaces being included
# oid = "IF-MIB::ifXTable"

[[inputs.snmp.table.field]]
  name = "ifName"
  oid = "IF-MIB::ifName"
  is_tag = true

[[inputs.snmp.table.field]]
  name = "ifHCOutOctets"
  oid = ".1.3.6.1.2.1.31.1.1.1.10"

[[inputs.snmp.table.field]]
  name = "ifHCInOctets"
  oid = ".1.3.6.1.2.1.31.1.1.1.6"

[[inputs.snmp.table.field]]
  oid = "IF-MIB::ifOperStatus"
  is_tag = true

#Other collected fields
[[inputs.snmp.field]]
 name = "PoEConsumedPower"
 oid = ".1.3.6.1.2.1.105.1.3.1.1.4.1"

[[inputs.snmp.field]]
 name = "CPU 1s"
 oid = ".1.3.6.1.4.1.9.6.1.101.1.7.0"

[[inputs.snmp.field]]
  name = "CPU 1m"
  oid = ".1.3.6.1.4.1.9.6.1.101.1.8.0"

[[inputs.snmp.field]]
  name = "CPU 5m"
  oid = ".1.3.6.1.4.1.9.6.1.101.1.9.0"

#Dropping the virtual interfaces reported as "Not Present"
[inputs.snmp.tagdrop]
  ifOperStatus = ["6"]
2

Hello @DeMoB ,
Are you able to return data if you do:

SELECT derivative(mean("ifHCInOctets"), 1s) /1000000*8 AS "In", derivative(mean("ifHCOutOctets"), 1s) /1000000 *-8 AS "Out" FROM "snmp" WHERE ("hostname" = 'Server-Room-C-POE') AND $timeFilter GROUP BY time($interval)

With no fill?
I can’t see why adding a fill null would not allow you to view the results especially if you can select for all those values.
Does this work?

SELECT "ifHCInOctets"FROM "snmp" WHERE ("hostname" = 'Server-Room-C-POE' AND "ifName" = 'gi1/0/1') AND $timeFilter GROUP BY time($__interval) fill(null)

Or this?

SELECT "ifHCInOctets"FROM "snmp" WHERE ("hostname" = 'Server-Room-C-POE' AND "ifName" = 'gi1/0/1') AND $timeFilter GROUP BY time($__interval)

That seems odd to me but I’m not that familiar with SNMP. @Jay_Clifford do you see something obvious here?

3

Hi, thanks for the suggestions, I’ve actually managed to get this data working by chance this morning.

Turns out that in swapping from the ifXTable to to explicitly adding the ifName as field with a tag, I’d created a field and a tag with the same name.

The key to get the data I want now requires a specific syntax in the format of

ifName::tag = 'gi1/0/1'

I’d previously tried this as “ifName”::tag, as per the documentation, but that hadn’t worked last week, perhaps due to being on an older version of InfluxDB?