DX NetOps

Hello,

We have multiple Linux devices being monitored in Spectrum which are generating a lot of High CPU alarms, however when we check the devices the CPU seems to be fine. Now I imagine that Spectrum is using 1.3.6.1.2.1.25.3.3.1.2 (hrPRocessorLoad) which actually only gives the average, over the last minute, of the percentage
of time that this processor was not idle. So lets say that the processor is used 2% for the whole of the minute, the load would show as 100 and trip our 85% threshold to create an alarm.

I have also looked at the following OID's:

1 minute Load: .1.3.6.1.4.1.2021.10.1.3.1
5 minute Load: .1.3.6.1.4.1.2021.10.1.3.2
15 minute Load: .1.3.6.1.4.1.2021.10.1.3.3
percentage of user CPU time: .1.3.6.1.4.1.2021.11.9.0
raw user cpu time: .1.3.6.1.4.1.2021.11.50.0
percentages of system CPU time: .1.3.6.1.4.1.2021.11.10.0
raw system cpu time: .1.3.6.1.4.1.2021.11.52.0
percentages of idle CPU time: .1.3.6.1.4.1.2021.11.11.0
raw idle cpu time: .1.3.6.1.4.1.2021.11.53.0
raw nice cpu time: .1.3.6.1.4.1.2021.11.51.0

However none of them give a simple percentage of the CPU usage which would work correctly with attribute redirection for monitoring.

Is there something I'm missing about monitoring Linux systems or is there a way to use the above information to get a simple percentage ?

The device sysobjectid is 1.3.6.1.4.1.8072.3.2.10.

In Spectrum it will depend upon the agent, but Spectrum will use RFC-2790 and/or Net-SNMP, with taking preference of using RFC-2790 for CPU calculations.

RFC2790 CPU utilization is a direct read from hrProcessorLoad/0xc4074a · 1.3.6.1.2.1.25.3.3.1.2

For Net-SNMP we use the following calculation:
 
ssCpuRawUser                          1.3.6.1.4.1.2021.11.50
ssCpuRawNice                          1.3.6.1.4.1.2021.11.51
ssCpuRawSystem                    1.3.6.1.4.1.2021.11.52
ssCpuRawIdle                            1.3.6.1.4.1.2021.11.53
ssCpuRawWait                          1.3.6.1.4.1.2021.11.54
ssCpuRawKernel                      1.3.6.1.4.1.2021.11.55
ssCpuRawInterrupt                 1.3.6.1.4.1.2021.11.56
ssCpuRawSoftIRQ                    1.3.6.1.4.1.2021.11.61
 
TotalTicks=Delta( C1, 1 ) + Delta ( C2, 2 ) + Delta( C3, 3 ) + Delta( C4, 4 )  + Delta( C5, 5 ) + Delta( C6, 6 ) + Delta( C7, 7 ) + Delta( C8, 8 )

-Where C# is the cached value from initial read and # is the last read. # corresponds to the index numbers above.
 
UsedTicks=TotalTicks - Delta( C4, 4 )
 
Utilization=( UsedTicks * 100 ) /  TotalTicks

If your not happy with RFC-2790, you may try installing Net-SNMP and then changing the Source in Spectrum to use Net-SNMP.

As most of the agents work on RFC-2790 or Net-SNMP, you can either use a Spectrowatch and create your own calculations, use a proprietary agent such as CA Unified Infrastructure Manager (UIM).

I hope this helps.

Best regards,

Glenn