Forum Discussion

Sudheer_Nair_88's avatar
Sudheer_Nair_88
Icon for Cirrus rankCirrus
Apr 28, 2011
Solved

Need help understanding SNMPTrap::::::Connection Limit Exceeded

Device: Bigip LTM running 9.4.5

 

 

Issue:

 

We are seeing regular occurence of the below SNMP alert in our monitoring console, but we were unable to find an issue or a relating log in the LTM.

 

 

SNMPTrap::::::Connection Limit Exceeded Connection Limit Exceeded

 

 

This alert occurs almost everyday, sometimes twice a day from only a couple of LTMs in our network. We are using EMC Smarts Incharge to monitor the network devices, and here is where we receive the alerts. In few cases, whenever this alert appeared, we have seen logs like below on the LTMs, but this is not the case always.

 

 

tmm tmm[1666]: 011e0001:4: Limiting closed port RST response from 324 to 250 packets/sec

 

tmm tmm[1666]: 01200006:4: Packet rejected remote IP 10.2.2.1 port 55409 local IP 10.10.10.4 port 443 proto TCP: Destination VIP disabled.

 

 

I did verify the SNMP configs at etc/alertd/alert.conf, config/user_alert.conf but did not see an alert configured for this. Also the EMC Smarts Incharge console doesnt display SNMP OID information for this alert ( I can see SNMP OID info for other alerts though).

 

 

Also, we do not have connection limit configured for any objects in our LTM.

 

 

I am trying to understand the cause behind this alert, any help or suggestion is highly appreciated.
management
monitoring
  • RACQ_74493's avatar
    RACQ_74493
    May 11, 2011
    The MIB that is in EMC is probably old and this is why you are seeing this message.

     

    We get this with our monitoring system as well and when I asked the vendor they said that it was from the MIB.

     

    We cannot update MIBs with our system. This occurred when we when to V10 and we are stuck with it. It is very annoying and we have had to write extra parsing on the message to filter this rubbish out.

     

     

    Cheers

     

    David.

6 Replies

Sort By
  • hooleylist's avatar
    hooleylist
    Icon for Cirrostratus rankCirrostratus
    Apr 28, 2011
    Hi Sudheer,

     

     

    That pair of alerts indicates that the 10.10.10.4:443 VS is disabled (or maybe the virtual address, 10.10.10.4 is disabled) and TMM is rejecting packets sent to it. Can you check if the VS is disabled?

     

     

    Aaron
  • Sudheer_Nair_88's avatar
    Sudheer_Nair_88
    Icon for Cirrus rankCirrus
    Apr 29, 2011
    Hi Aron

     

     

    Yes, the VS is disabled, so TMM rejecting traffic is normal.

     

     

    My worry is about the SNMPTrap: Connection Limit Exceed, for which i have been not able to find a clue.

     

     

    Also, this log doesn't appear every time i see the SNMPTrap, it is only in few cases that the log followed the trap.

     

     

  • Michael_Yates's avatar
    Michael_Yates
    Icon for Nimbostratus rankNimbostratus
    Apr 29, 2011
    If I am reading your post correctly you said that you are getting the "SNMPTrap::::::Connection Limit Exceeded Connection Limit Exceeded" alert in your monitoring console.

     

     

    I don't believe that this is a problem with your BigIP, it might be a limitation of your monitoring console getting flooded with SNMP Traps from the BigIP. The notifications should be proportional to the amount of incidents that the BigIP is trying to notify you about (in this case it could be the traffic rejected by a disabled VIP or a combination with other events).

     

     

    I've gotten the same type of Packet rejected messages that you are getting in your LTM Log, they are just informational. They only impact they have is increasing your LTM Log File Size. If you want to get rid of the alerts you can enable the VIP and apply a traffic drop iRule on it.
  • Sudheer_Nair_88's avatar
    Sudheer_Nair_88
    Icon for Cirrus rankCirrus
    Apr 30, 2011
    Thanks Michael Even i suspect, if the EMC Smarts monitoring tool is misconfigured. Let me dig further..
  • RACQ_74493's avatar
    RACQ_74493
    Icon for Cirrus rankCirrus
    May 11, 2011
    The MIB that is in EMC is probably old and this is why you are seeing this message.

     

    We get this with our monitoring system as well and when I asked the vendor they said that it was from the MIB.

     

    We cannot update MIBs with our system. This occurred when we when to V10 and we are stuck with it. It is very annoying and we have had to write extra parsing on the message to filter this rubbish out.

     

     

    Cheers

     

    David.
  • Sudheer_Nair_88's avatar
    Sudheer_Nair_88
    Icon for Cirrus rankCirrus
    May 13, 2011
    Yeppy :) the mystery unwinded atlast, it was a wrong SNMP OID that's configured on the monitoring console..

     

    The SNMP guys are correcting it, happy that we wont see the false alarm again :)

     

     

    LTM was reporting the event "Packet rejected for disabled VIP" but the monitoring tool was sensing it as "Connection Limit Exceed" due to the misconfigured SNMP OID.

     

     

    Thanks for all inputs throughout.