CPU Utilization showing incorrect spikes

Products

• Network Observability
• CA Performance Management

Issue/Introduction

CPU utilization for the  Check Point 19200 appliance is showing incorrect spikes for 'Utilization by Percentage'

Environment

Dx Netops Performance Management 24.3.10

Cause

Device Bug

 

 

Resolution

The backing vendor cert for CPU is 'CheckPoint Multi CPU', which utilizes the following to calculate Utilization

<Expression destAttr="Utilization">multiProcUsage</Expression>

<Attribute name="multiProcUsage" type="Long">
<Documentation/>
<IsKey>false</IsKey>
<NeedsDelta>false</NeedsDelta>
<Source>1.3.6.1.4.1.2620.1.6.7.5.1.5</Source>
</Attribute>

 

According Checkpoint the better OID to use is  1.3.6.1.4.1.2021.10.1.3.1

snmptranslate -Td  1.3.6.1.4.1.2021.10.1.3.1
UCD-SNMP-MIB::laLoad.1
laLoad OBJECT-TYPE
  -- FROM       UCD-SNMP-MIB
  -- TEXTUAL CONVENTION DisplayString
  SYNTAX        OCTET STRING (0..255)
  DISPLAY-HINT  "255a"
  MAX-ACCESS    read-only
  STATUS        current
  DESCRIPTION   "The 1,5 and 15 minute load averages (one per row)."
::= { iso(1) org(3) dod(6) internet(1) private(4) enterprises(1) ucdavis(2021) laTable(10) laEntry(1) laLoad(3) 1 }

 

... which is found in the 'CPU Load Last 1min' vendor cert

 

You must change the vendor cert priority list to ensure the 'CPU Load Last 1min' vendor cert is above 'CheckPoint Multi CPU' int he vendor cert list

 

Prioritize the Vendor Certifications Within a Metric Family