[f-nsp] Strange SNMP logs/Slowdown

[Franz Georg Köhler]

On Di, Sep 18, 2018 at 11:01:21 -0600, Daniel Schmidt <daniel.schmidt at wyo.gov> wrote:
> I've a strange issue - just one of my MLX polls very, very slowly for no
> discernible reason.  A simple snmpwalk confirms this.  Fearing it was
> somehow being over polled, I added log statements to my snmp acl.  I did
> not find evidence of excessive polling, however, I got strange log messages:
> 
> #show log | i list 1
> Sep 17 16:18:26:W:ACL: ACL: list 1 denied udp 192.0.2.153(0)(Ethernet mgmt1
> cc4e.24XX.XXXX) -> 198.51.100.1(snmp), 8414208 event(s)
> Sep 17 16:13:26:W:ACL: ACL: list 1 denied udp 192.0.2.153(0)(Ethernet mgmt1
> cc4e.24XX.XXXX) -> 198.51.100.1(snmp), 8414208 event(s)

Is cc4e.24XX.XXXX your router's mac?
198.51.100.1 is your router's IP on mgmt port?

For the SNMP issue you could change community and make a test poll.
Does the SNMP process take up too much CPU?

> They didn't increment, mgmt1 is down, acl list 1 doesn't exist nor was the
> mac in the table.  The other messages all make sense, but this one - this
> is just weird.  I'm still running 5.8.0h and have no plans to go to 6 till
> they add my "ipv6 loopback in vrf can't ping" fix to the code.

Does it work in 5.8?

> I suppose I simply will reboot it, as my last tac case was easily recreated
> yet caused me to beat my head against the wall till my coworkers questioned
> my sanity.  (A week to explain, a week for them to lab it up and then I had
> to argue that it was wrong because they didn't even use a VRF, much less
> MPLS)  Can't reboot till next week and my head is still sore from the last
> tac case.

Another thing is that the issue might come back even if solved after
reboot (if it is software defect).