Server Management - Systems Insight Manager
cancel
Showing results for 
Search instead for 
Did you mean: 

Multiple "link up" messages, SP 8.25A, Windows 2008

 
SOLVED
Go to solution
suzan maxey
Frequent Advisor

Multiple "link up" messages, SP 8.25A, Windows 2008

I recently built the first Windows 2008 (standard) server in our domain and installed SP 8.25A. During reboots of the server, I receive a normal series of emails from my Insigh Manager server except for a deluge of about a dozen "link up" messages at the end of the boot process. Any insight as to what is going on (and hints on how to fix it!) would be appreciated. Thanks.
11 REPLIES
John Benak
Occasional Advisor

Re: Multiple "link up" messages, SP 8.25A, Windows 2008

Got the same problem. Rolling out 2K8 in our enterprise and the same thing happens. Only thing I've been able to ID so far is that looking at the server in HP Sim 'data collection' page shows about 12 NICs, each with the same MAC addy. We're thinking it might be something to do with the redesigned 2008 network stack, and HP Sim is seeing them as separate NICs as opposed to the same one. BTW - this is an ESX Guest VM, and the problem is replicated on all. Please let me know if you come up with anything.
suzan maxey
Frequent Advisor

Re: Multiple "link up" messages, SP 8.25A, Windows 2008

I also noted the multiple NICs in the data report, went to the server, and disabled everything except IPv4. Still the same result on reboot: a torrent of LinkUp messages. I rebuilt the server with a different name, installed an earlier SP, hoping that something had gotten screwed up the first time. Same result, though.

I finally ended up going to Insight Manager and disabling the LinkUp trap. (Options -> Events->SNMP trap settings.) the trap is in mib rfc1215. I still get enough traps on reboots to tell what is going on (coldstart, etc) but it keeps my mailbox from being flooded with LinkUp traps. Not the optimum solution but that's the best I could come up with.
John Benak
Occasional Advisor

Re: Multiple "link up" messages, SP 8.25A, Windows 2008

Thanks for the info. Disabling the 'link up' component isn't really a solution for us. I'll look around a little more and then call HP support if I don't find anything. If I get a solution from them I'll report it here.
CNUXX
Occasional Visitor

Re: Multiple "link up" messages, SP 8.25A, Windows 2008

I also have the same problem. Were you able to get a resolution/explanation from HP?
John Benak
Occasional Advisor

Re: Multiple "link up" messages, SP 8.25A, Windows 2008

I worked with HPSim support yesterday, and we were able to determine that this isn't a problem with HPSim per se, so much as something with SNMP in Win2008 (or SNMP in 2008 on VMware guest). We confirmed that by runningg SMNPUtil on our HPSim box, rebooting the 2008 server, and watching the raw traps coming in from the test 2008 box. HPSim was only reporting what it was getting.

What I'm not sure yet is if this is specific to ESX VM Guests, or whether this will be the case with physical servers as well. All of our 2K8's are ESX VM's right now, but I'm in the process of building out a physical server to see if there's any difference in the trap reports. The VM guests don't have the agent installed, so that may be a factor as well.

Has anyone seen these errors on physical servers? Please let me know what your experiences have been with this.

Google hasn't been too helpful. If I can get some info on your experiences/scenarios, I'll go to either MS PSS or VMWare support next and post results.
Thanks,
John
suzan maxey
Frequent Advisor

Re: Multiple "link up" messages, SP 8.25A, Windows 2008

The server I'm having issues with is a physical server -- Proliant DL360 G6 -- so this isn't limited to VMs.
CNUXX
Occasional Visitor

Re: Multiple "link up" messages, SP 8.25A, Windows 2008

I am having the problem on a DL380 G6 running Windows Server 2008 SP2 with the Hyper-V role enabled. Perhaps each HP agent and/or service is sending a message that it has started. I noticed that agent name is missing. Additionally are all of you using SNMP instead of WBEM?

A linkUp trap signifies that the sending protocol entity recognizes that one of the communication links represented in the agent``s configuration has come up.
John Benak
Occasional Advisor

Re: Multiple "link up" messages, SP 8.25A, Windows 2008

Not sure about WBEM, as I didn't build the HPSim infrastructure. Can you enlighten me about it? As for SNMP, we're certainly using it.

To illustrate what I'm talking about with my issue, take a look at a 2K3 server and a 2K8 server. Go to the 'Tools and Links" tab for that server and run the 'Data Collection Report'. In my case, comparing 2 VMs in this report I get significantly different results, notably in the network/NIC section. Where there is only 1 entry in the 2K3 report, there are about 15 in the 2K8 one - most reporting the same MAC addy.

I think this has something to do with the new 2008 network stack/config. SNMP is reporting 'linkup' for each protocol, instead of just for the NIC/IP. What I'd like to be able to do is turn off the firehose of info.
John Benak
Occasional Advisor

Re: Multiple "link up" messages, SP 8.25A, Windows 2008

I opened a MS PSS ticket this AM, during which I clearly and undisputedly demonstrated & illustrated the nature of this problem via the HPSim interface and the shower of notifications during a 2K8 reboot. Got a "That's interesting... let me put you on hold...".

After having checked things out with a Escalation Tech, I was told the following by PSS:


"As we discussed, it appears that Windows Server 2008 is sending traps on the additional interfaces (ipv6, wan-mini, qos, etc) where 2003 did not. I will dig into the captures you provided. Unfortunately, if this is the case, there is currently no configuration granularity within the available SNMP interfaces that would allow you specify which interfaces to alert on. The solution may be to turn of Physical alerting, as being suggested in the HP threads, and using EVNTWin to alert on selected Event Log entries, such a start up events or service start event."

The latter suggestion is the use of a little-known utility to create custom alerts. Not sure how efficient this will be in a large enterprise.

I sent him network captures that the HPSim box received during a 2008 server reboot, so it's not TOTALLY written off, but it doesn't look like this is configurable from the 2008 OS perspective.

HP is coming in a week or so to upgrade our HPSim to the most recent version. Is anyone running the most recent, and is there any way to trim the alerts at the HPSim point in this version?

If PSS comes back with anything else, I will post results here.
John Benak
Occasional Advisor
Solution

Re: Multiple "link up" messages, SP 8.25A, Windows 2008

Got what seems to be the 'final' answer from MS PSS on this. The short answer is that 'yes, this is indeed an issue; no, you can't control it.'

I sent some network captures from our HPSim server during a 2008 server reboot, as well as some other data. The MS tech was also able to replicate the issue in his lab. His only suggestion was to disable the 'LinkUp' alerts altogether (as was mentioned above) and either rely on the 'ColdStart' for reboot notifications, or create a customized alert from a particular EventID using a built-in windows utility called 'EventWin' .

Not sure how feasible the latter solution is in a large enterprise, as I don't know too much about EventWin. TBD... I think now that we have some definitive info on this, we're probably going to go ahead and disable the "LinkUp's". We have SCOM 2007 deployed in our infrastructure as well, so we're probably going to look to and rely on that tool to give us the info that the missing 'LinkUps' provided.

Below is the response from MS PSS on the issue:

John:
"I reviewed the capture, and you can clearly see the 2008 box sending the SNMP Traps. The count corresponds with the e-mail alerts you reviewed. I have tested this in my lab environment and saw consistent behavior.

I also found the SNMPUtil output interesting. As there is no way to control this behavior, it may be best to reconfigure the alerting using a different trigger as we discussed. One possibility could be to use evntwin to generate a trap based on the following, as the event is triggered only once during boot:

Log: System
Source: EventLog
ID: 6005 The Event log has started"


Thanks for all of your helpful feedback troubleshooting this issue, and best of luck! If any of you (or others who run across this post later!) come up with a better solution, please post it here.

Tx,
John in Austin, TX
suzan maxey
Frequent Advisor

Re: Multiple "link up" messages, SP 8.25A, Windows 2008

Thanks very much for all of your detective work, John.