Syslog - SNMP-3-INPUT_QFULL_ERR

Syslog - SNMP-3-INPUT_QFULL_ERR

ICSeverity (customer severity)

3

Impact

SNMP is a low priority protocol, and whenever there is a choice between a higher priority task and a protocol like SNMP, device discards SNMP packets first.

If the syslog has occurred once/ a few times and is not showing up often, it can be safely ignored.

In some situations, there can be a software defect which can cause unexpected/suboptimal operation of the SNMP process. Please review the list of known defects shown next and consider upgrading the software of the cisco device in question to the recommended/latest version to ensure that most known software fixes are present in the software in use.

Description

This error usually means that the Syslog queue is full on the device hence the device is unable to process incoming SNMP Packets.

This can happen due to these next reasons:

• CPU is busy processing other high priority packets, hence does not process low-priority SNMP messages.
• SNMP input queue is out of buffers hence unable to process more incoming packets.
• Possible memory leak issue -> Contact TAC to check this.
• Possible defects on the device.

SyslogMessage

SNMP-3-INPUT_QFULL_ERR: 

Packed dropped due to input queue full.

MessageSample

SNMP-3-INPUT_QFULL_ERR: 

Packed dropped due to input queue full.

ProductFamily

All Catalyst platforms

Regex

N/A

Recommendation

• Increase the polling interval. 
• If there are specific OIDs being polled often, you can change the interval for those or remove them if polling is not needed.
• Often a warm restart of SNMP Engine is recommended for a queue full issue. To do this:
  • no snmp-server
  • sh snmp  - to verify snmp is disabled.
  • sh proc cpu |  I SNMP Engine —> to verify snmp is disabled.
• Reconfigure SNMP with the command,  snmp-server .
• .Increase SNMP queue size. This is a workaround and NOT a fix. 
• To identify the exact root cause or if suspecting a defect, please open a TAC SR. 
• You can increase the time threshold using this command:
  • snmp monitor response threshold 5000.
• You can also use the configuration command  no snmp monitor response . This command would disable the mechanism to compare response time with threshold and no delay messages are displayed.
• Also, these logs are just informational so you can delete these logs permanently.

Commands

show proc cpu sorted  -> to verify CPU percentage on the device and CPU percentage on SNMP Engine process

show proc cpu | I SNMPEngine

show snmp stats oid  -> to check which oid is keeping SNMP Engine busy

show snmp