False ICMP Ping Loss

[samuk10]

SUMMARY

Randomly hosts alarms ping loss.
Using standard ICMP Ping template.
On provisioning server this doesnt happen.

OS / ENVIRONMENT / Used docker-compose files

Zabbix server 5.4.7 with PostgreSQL

CONFIGURATION

NO CHANGES

STEPS TO REPRODUCE

docker exec -it docker-zabbix_zabbix-server_1 fping -c 500 <any host>
NO LOSS

EXPECTED RESULTS

ACTUAL RESULTS

Doesnt alarm "response or ping down".
Just "High ICMP ping loss 33.33 %" with 33.33%

[dotneft]

Please attach graph or plain text values for the item and item key you have.

[samuk10]

Alarm amount:

The server process:

The trigger

[dotneft]

is it the same host all time? Or different ones in random time? I recommend you enable debug mode for "pinger" process and check what exactly it receives.

[samuk10]

random hosts.
debug mode like this? https://www.zabbix.com/documentation/current/en/manual/web_interface/debug_mode

[dotneft]

No, this one:

zabbix_server -R log_level_increase="icmp pinger"

[samuk10]

Just enabled debug

  root@zabbix-server:/var/lib/zabbix# zabbix_server -R log_level_increase="icmp pinger"
  zabbix_server [13835]: command sent successfully

the alarm ping loss on 6 hosts on diferent places, i ping inside the docker container from one of then while the alarm was still up:

root@zabbix-server:/var/lib/zabbix# fping -c 100 10.2.30.2
10.2.30.2 : xmt/rcv/%loss = 100/100/0%, min/avg/max = 1.79/2.09/9.59

No new logs

   308:20211203:190144.974 log level has been increased to 2 (error)
   311:20211203:190144.983 log level has been increased to 2 (error)
   315:20211203:190144.988 log level has been increased to 2 (error)
   316:20211203:190145.014 log level has been increased to 2 (error)
Cannot find module (DMOS-SYSMON-MIB): At line 1 in (none)
Cannot find module (DMOS-HW-MONITOR-MIB): At line 1 in (none)
Cannot find module (DMOS-SYSMON-MIB): At line 1 in (none)
Cannot find module (DMOS-HW-MONITOR-MIB): At line 1 in (none)
Cannot find module (DMOS-SYSMON-MIB): At line 1 in (none)
Cannot find module (DMOS-HW-MONITOR-MIB): At line 1 in (none)
Cannot find module (DMOS-SYSMON-MIB): At line 1 in (none)
Cannot find module (DMOS-SYSMON-MIB): At line 1 in (none)
Cannot find module (DMOS-HW-MONITOR-MIB): At line 1 in (none)
Cannot find module (DMOS-SYSMON-MIB): At line 1 in (none)
Cannot find module (DMOS-HW-MONITOR-MIB): At line 1 in (none)
Cannot find module (DMOS-SYSMON-MIB): At line 1 in (none)
   309:20211203:190547.003 log level has been increased to 3 (warning)
   313:20211203:190547.003 log level has been increased to 3 (warning)
   308:20211203:190547.003 log level has been increased to 3 (warning)
   312:20211203:190547.003 log level has been increased to 3 (warning)
   310:20211203:190547.003 log level has been increased to 3 (warning)
   315:20211203:190547.003 log level has been increased to 3 (warning)
   314:20211203:190547.003 log level has been increased to 3 (warning)
   316:20211203:190547.004 log level has been increased to 3 (warning)
   317:20211203:190547.004 log level has been increased to 3 (warning)
   311:20211203:190547.004 log level has been increased to 3 (warning)
Cannot find module (DMOS-HW-MONITOR-MIB): At line 1 in (none)
Cannot find module (DMOS-SYSMON-MIB): At line 1 in (none)```

[dotneft]

you need increase log level to 4 (debug) level to see raw data from icmp pinger. warning level does not contain any valuable information. Also maybe you monitor these hosts through Zabbix proxies?

[samuk10]

"Also maybe you monitor these hosts through Zabbix proxies?" Sry for my english. This is a tip?
I dont have proxyes yet, will try to implement next.

[dotneft]

It is not a tip, just where from collect debug info.

[samuk10]

Sorry for the inconvenience.
Was having some high bandwidth on some hosts causing icmp loss...