High volume of SNMP traffic from OpenNMS to managed node (1000 pps)

Description

Device with limited SNMP support is provisioned in OpenNMS (ICMP and SNMP service).

(some data are replaced by xxxx)

[root@nms ~]# snmpwalk -v 2c -c public x.x.x.x
SNMPv2-MIB::sysDescr.0 = STRING: xxx 1950 3.3.0.10182.2
SNMPv2-MIB::sysObjectID.0 = OID: SNMPv2-SMI::enterprises.10734.1.4.3
DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (467933637) 54 days, 3:48:56.37
SNMPv2-MIB::sysContact.0 = STRING: xxxx
SNMPv2-MIB::sysName.0 = STRING: xxxx
SNMPv2-MIB::sysLocation.0 = STRING: xxxx
SNMPv2-MIB::sysServices.0 = INTEGER: 76

That's all what we get.

After some time OpenNMS starts to send enormous SNMP traffic to node (1000 pps / ~2 Mbit), which kills it or at least it causes high load (depends on device type):

OpenNMS get:
getBulkRequest 1.3.6.1.2.1.4.22.1.1 1.3.6.1.2.1.4.22.1.2 1.3.6.1.2.1.4.22.1.3 1.3.6.1.2.1.4.22.1.4 1.3.6.1.2.1.4.21.1.1 1.3.6.1.2.1.4.21.1.2 1.3.6.1.2.1.4.21.1.3 1.3.6.1.2.1.4.21.1.4 1.3.6.1.2.1.4.21.1.5 1.3.6.1.2.1.4.21.1.6
Node response:
get-response (no variable-bindings)

This happens 1000 times per second. According to OIDs OpenNMS is trying to get ipRouteTable and ipNetToMediaTable from node.
The issue probably is that node replies with blank message, so there is neither timeout nor any information requested.

What makes it even worse is that deleting SNMP service or reprovisioning node without SNMP doesn't help. It's probably related to another bug:
http://issues.opennms.org/browse/NMS-1996
After OpenNMS restart it's OK for approx. 6 hours and then it starts high load again - polling the device even if there is ICMP service only (after reprovisioning) - SNMP must be stuck in database somewhere.

Fortunately I found a workaround - adding the node IP to exclude-range in collectd-configuration.xml stops it. Or node IP address must be changed.

Environment

CentOS 6.2

Acceptance / Success Criteria

None

Lucidchart Diagrams

Activity

Show:

Jesse White July 31, 2019 at 6:28 PM

I suspect this may be related to https://issues.opennms.org/browse/NMS-10621. Feel free to reopen if the behavior persists in a recent release.

Ondrej D. July 31, 2012 at 5:11 AM

Yes, linkd is turned on.

Seth Leger July 30, 2012 at 7:10 PM

I'm guessing that this is linkd scanning the node for topology information out of the ipNetToMedia and ipRouteTable entries. Do you have linkd turned on for this IP address?

Duplicate

Details

Assignee

Reporter

Components

Affects versions

Priority

PagerDuty

Created May 21, 2012 at 7:28 AM
Updated July 31, 2019 at 6:28 PM
Resolved July 31, 2019 at 6:28 PM