Reducing the maximum number of OIDs queried in a single batch in OM 2012

  • Article

Ran into a nice issue when actvating advanced network performance monitoring on a Cisco ASA firewall. In the Cisco system logs:

"incoming SNMP request ( # bytes) from IP address IP_ADDRESS and PORT PORT_NUMBER Interface "inside" exceeds data buffer size, discarding the SNMP request"

This scenario can happen on some network devices in case that the maximum number (default 50) of OIDs that OM will query per batch is too high. Setting this to a lower number will solve this issue.

Just create this registry key:

  • location: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft Operations Manager\3.0\Modules\Global\SNMP]
  • key type: DWORD value
  • key name: MaxOidsPerRequest
  • default: 50

It is near impossible to say what the size of the packet will be given a request size as the data varies from request to request, but something like 10 is probably a good starting point (20% of the default). 

Too low a value could increase the load on the device as each request is effectively an interrupt and carries with it a certain cost, so too a point the higher the better.

On the opposite side of the fence the devices themselves generally will reject requests if they are too large, the reasoning is that serving SNMP requests is an ancillary feature to providing network service so it gets throttled back to not introduce too much network lag (spreading the load out has greater overall impact on the device but will not interrupt a single network packet for too long).

In short we settled on 50 after a fair amount of research and tuning so the closer you can get to that the better ;)

 

CHEERS!