WhatsUp Gold defines interface active monitor states for SNMP based monitors using the details below.
Interface active monitor uses SNMP protocol to obtain the value of the ifOperStatus (OID: 188.8.131.52.184.108.40.206.1.8.x where x is the SNMP index of the interface) from the device to which the interface belongs to. This value is then interpreted as per RFC-1213 to decide Up (value of 1) or Down (value of 2) for the interface. The values for the SNMP active monitor states cannot be changed within the application as they are based on the standards defined by IETF. Values for ifOperStatus and ifAdminStatus are defined in RFC-1213.
Interface Active Monitors have an “argument” that indicates the index of the interface as reported by the device. The index list is retrieved by using the iftable (220.127.116.11.18.104.22.168) from the device. That index is used in gathering details from additional SNMP OIDs which indicate the specifics of the interface including ifDescr, IfName, IfType, IfSpeed, IfOperStatus, IfAdminStatus, etc.
When a device is discovered and added to Monitoring (My Network) from the Discovered device list, Interface Active Monitors are added to the device. The device is assigned a Role or Subrole that has the Interface Active Monitors in the Monitors list for that Role and 2) If the device supports Interfaces active monitors meaning that the device can successfully get the list of interfaces from the iftable and those interfaces report as “UP”(See ifOperStatus above).
SNMP interface Active Monitor States
As indicated above, Interface active monitors check the ifoperstatus of interfaces that have an enabled Interface active monitor (as indicated in the device properties / Monitors dialog). The expectation is that the ifoperstatus will return a “1” (UP) for devices that are operationally up which is reported as “UP” in WhatsUp Gold when the monitor is polled. If ifOperstatus reports “2” (DOWN) the interface is listed as “Down” in WhatsUp Gold.
To determine why an interface is showing down, start by investigating the state change timeline for the device (in the Device Properties, click on the device menu at the top right of the dialog and select “State Change Timeline”. When reviewing the State change timeline for the device with the Interface active monitor reporting as “down” the most common Messages indicating why the monitor is down is 1) Device reported “2” for the operational status of that interface and 2) A Timeout.
Timeout indicates that a request was sent to the device for the specific Interface and no response was returned OR the response was returned outside of the default timeout period and retries specified in the active monitor configuration. This response can indicate that the device was unable to respond to the SNMP request because the device is too busy, there is a slowness on the network, the device is down, the SNMP credential is incorrect or changed, etc. If the timeout is sporadic and the interface is sometimes up, the likelihood is that there is a delay getting the response from the device either due to network congestion or a slowness of the SNMP agent on the device. The default timeout for the Interface active monitor is 2 seconds and is set for 1 retry. WhatsUp Gold will send a request and wait 2 seconds, if no request returns in that timeframe anther request is sent. If no request returns in that timeframe, the interface is considered down. The Timeout and retries can be set to allow for a longer timeout or number of retries in the Monitors library (Interface active monitor and click on Advanced options), however this setting impacts ALL devices that use the Interface active monitor.
One of the tools available within WhatsUp Gold to check the current status for the Interfaces is called the SNMP MIB Walker:
When Looking at the down Interface active monitor on your device, please note the “index” for that specific Interface.