1. Symptom
After paloalto found zabbix firewall upgrade monitoring of its CPU, fan and other hardware port traffic information and data errors.
2. Phenomenon
Since zabbix has not been any changes to the firewall just to upgrade. According phenomenon is not good investigation. But monitoring is SNMP-based, so we follow the idea of SNMP to monitor.
3. investigation
Use MIB Browser calls PAN-COMMON-MIB library discovery has changed before oid contrast to some of the corresponding hardware upgrades.
At this point oid zabbix modified in a number of monitored items part of the solution, such as CPU, fan. But the port are all port traffic flow is still displayed on the MIB Browser 0. and indeed are 0.
In zabbix server, use the command snmpwalk -v 2c -c snmpcommunity xxxx oid and get all the results of the firewall. The results showed that the former was found oid corresponding result value is 0;
IF-MIB::ifInOctets.16 = Counter32: 0
IF-MIB::ifInOctets.17 = Counter32: 0
IF-MIB::ifInOctets.18 = Counter32: 0
But found
IF-MIB::ifHCInUcastPkts.16 = Counter64: 13755325
IF-MIB::ifHCInUcastPkts.17 = Counter64: 34390457150
IF-MIB::ifHCInUcastPkts.18 = Counter64: 70364539089
Based on actual usage inference, oid should be that after the change.
Zabbix can then adjust lower.