1

We ran out of space on a 5 TB volume on a Windows storage server, so we copied the data into a new 10 TB volume.

Now our nagios-based monitoring is reporting data I'm not happy with. When I looked into the data, I noticed that it reports a negative value for the total space of the volume.

  • Status Information:
    V: Label:VolumeXYZ Serial Number f6435543: -72%used(4545076MB/-6291462MB) (<80%) : OK
  • Performance Data: 'V:_Label:VolumeXYZ__Serial_Number_f6435543'=4545076MB;-5033169;-5662316;0;-6291462

At first I assumed a cache issue, but made my way to manually looking up the values via snmpwalk. The results were:

iso.3.6.1.2.1.25.2.3.1.1.6 = INTEGER: 6
iso.3.6.1.2.1.25.2.3.1.2.6 = OID: iso.3.6.1.2.1.25.2.1.4
iso.3.6.1.2.1.25.2.3.1.3.6 = STRING: "V:\\ Label:VolumeXYZ  Serial Number f6435543"
iso.3.6.1.2.1.25.2.3.1.4.6 = INTEGER: 4096
iso.3.6.1.2.1.25.2.3.1.5.6 = INTEGER: -1610614235
iso.3.6.1.2.1.25.2.3.1.6.6 = INTEGER: 1163527892
iso.3.6.1.2.1.25.2.3.1.7.6 = Counter32: 0

Given that all other volumes report a positive value in the iso.3.6.1.2.1.25.2.3.1.5 branch, I'm assuming that seeing a negative value here for the volume in question, is an indicator of why I'm seeing a negative value in nagios.

How can I remedy this situation?

1 Answer 1

3

The negative number is because of an integer overflow for the signed 32 bit integer used to report the number of blocks.

I've had the same problem on a Linux-based NAS. I was able to fake a larger block size in Linux, which prevented the integer overflow and the product of block size * number of blocks resulted in the correct amount of storage. The bug is reported for Net-SNMP and there's a patch available. I'm unsure if you're able to tweak a Windows system in the same way.

3
  • Just to add a note - Microsoft has deprecated its built-in SNMP engine, so you're not likely to see any more updates or fixes to it. Ever. And it will probably disappear completely from future versions of Windows. There are much better and more preferable ways to monitor a Windows system than SNMP. If you still have to have SNMP, then you will need to seek a 3rd-party replacement for the SNMP engine.
    – Ryan Ries
    Sep 21, 2014 at 17:00
  • @RyanRies Would you be able to name a more preferable way to monitor the systems? Sep 21, 2014 at 22:48
  • 1
    @OliverSalzburg WMI.
    – Ryan Ries
    Sep 21, 2014 at 23:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .