snmp.server.busy

[MohamedShehata]

hello all,

we have a netapp storage running cdot [version: NetApp Release 9.6P3 ], we have  the below issue and need to know the solution or the troubleshooting steps for it: 

Event:
snmp.server.busy: SNMP daemon is busy serving a high rate of incoming SNMP queries.
Message Name:
snmp.server.busy
Description:
This message occurs when the SNMP daemon is busy serving a high rate of incoming SNMP queries. This might be caused by multiple SNMP clients querying the cluster or a malicious client attempting a denial-of-service attack. SNMP clients might experience delays or timeouts.

[ttran]

Hello @MohamedShehata ,

If these SNMP errors occurred recently and your system has been running for an extended time, these "snmp.server.busy" messages could be caused by a recent issue on your system that is internally sending "Health Alerts" using SNMP.

You can fun the following command from the Cluster shell to see if there are any internal alerts on the Cluster that needs addressing: "::> system health alert show -instance". If there are alerts and after you address the issue, you will then need to manually delete the health alert from the Cluster shell using "

Command Reference: System Health Commands 

If there are no Health Alerts on the system, you can also try to increase the timeout value on your SNMP Server to allow more timeout for pending requests to complete, which will reduce the amount of retransmits/re-polling.

Regards,

Team NetApp

[pedro_rocha]

Isn't this about incoming queries? Maybe his monitoring system is querying too much.

[wareer]

Run "tcpdump" on cluster to determine: If multiple SNMP clients querying the cluster, then reduce the rate of SNMP queries to the cluster or stop them entirely for a period of time (~15 minutes). If a malicious SNMP client is trying a denial-of-service attack, then update the firewall policy to block the client from querying the cluster by using the "firewall policy modify -policy mgmt -service snmp -action deny -ip-list IP_address" command.It could be the solution in this kb：https://kb.netapp.com/on-prem/ontap/Ontap_OS/OS-KBs/EMS_reports_snmp.server.busy