Problem between ASA 5510 - CiscoWorks

Answered Question
May 12th, 2010
User Badges:

Hello,

the following problem appeared when i enabled syslog on ASA-5510 : every minute it generates 8-10 messages with the following text:


incoming SNMP request (736 bytes) from IP address <CiscoWorks' IP address> Port 2946  Interface "inside" exceeds data buffer size, discarding this SNMP request.


I have read that it could be a problem with pollers, so first i made separate poller only for the ASA, then disabled it completely but these messages keep arriving.

I also searched if there is an option to reduce this size in CiscoWorks, but haven't found any.

Do you have any suggestions on how to eliminate this problem, because it floods the syslog server really quickly, or maybe some command that i can enter on ASA's CLI to expand its buffer size?

Thanks in advance.

P.S. I am currently running LMS version 3.2

Correct Answer by Joe Clarke about 6 years 10 months ago

It would be helpful to see a packet capture of these SNMP packets to see what application is generating them.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
Correct Answer
Joe Clarke Wed, 05/12/2010 - 11:44
User Badges:
  • Cisco Employee,
  • Hall of Fame,

    Founding Member

It would be helpful to see a packet capture of these SNMP packets to see what application is generating them.

Rattlesnake_bac Thu, 05/13/2010 - 02:57
User Badges:

Well, i ran packet capture and i noticed the following:


IF-MIB::ifInDiscards.11 (1.3.6.1.2.1.2.2.1.13.11): unSpecified

IF-MIB::ifOutErrors.11 (1.3.6.1.2.1.2.2.1.20.11): unSpecified

IF-MIB::ifInErrors.11 (1.3.6.1.2.1.2.2.1.14.11): unSpecified

IF-MIB::ifOutDiscards.10 (1.3.6.1.2.1.2.2.1.19.10): unSpecified


There is a poller template called "Interface errors" containing these four variables, but it can't be disabled or deleted since it's created by the system.

I temporarily disabled all the pollers using this template but the SNMP requests keep running.


EDIT: After reloading the server with CiscoWorks on it the SNMP requests stopped. Now everything's fine. Thanks for your support.

Actions

This Discussion