net-snmp-5.3.1-19.el5 is quite old, could you please update to net-snmp-5.3.2.2-7, released in RHEL 5.4 update? The bug might be fixed there.

In addition, it's hard to guess what causes the syslog message - it's written by internal function, which tries to recalculate 32bit counter reported by kernel to 64bit counter, required by SNMP standards. But there is lot of such counters and without knowing which one shows this error, I can hardly help you.

What information do you query snmpd for? Would it be possible to attach debugger to the snmpd, place breakpoint at line int64.c:429 (where the error is shown) and send me a stack trace when the snmpd hits this line?

Thanks for pick up.

I can not reproduce this symptom at will.
So it would be hard to tell when I get the next one.

You wrote "snmpd recalculate 32bit counter reported 
by kernel to 64bit counter".
Which means, is this an "Error" message, or 
it just an evidence that s/w made a bit conversion
from 32 to 64. 
I hope this message is not harmful.

(In reply to comment #2)
> I hope this message is not harmful.  

Well, it indicates that at least one of the reported counters is misleading. It has no effect on snmpd stability or the other values reported by it.

There is one more system which has similar messages
with newer (not latest) net-snmpd.

OS: 2.6.18-92.1.17.el5 (x86_64)
RPM: net-snmp-5.3.1-24.el5_2.2

I plan to capture the snmp query packet on the line.
Stay tune.

Hello,

there is another bug report regarding the same error message, see bug #542826. It might be completelly unrelated to this one, but just to be sure, could you please post content of /proc/net/dev at the time the error shows up?

And if the error is shown repeatedly, could you please attach "strace -ttt -s 9999" to snmpd, let it gather info for couple of minutes when the error shows up and send me the log?  Beware, it might contain sensitive data. I am interested what data is snmpd reading from /proc filesystem, because that are the values which probably cause the error you see. You can obfuscate incoming/outgoing packets, any passwords etc.

Thanks in advance

Dear Masanari,

I am still waiting for the strace logs and content of /proc/net/dev requested in comment #5. Have you managed to get some? Or did the error disappear after updating to RHEL 5.4?

Created attachment 448580 [details]
output of strace -ttt -s 9999 snmpd

output of strace -ttt -s 9999 snmpd -Lsd -Lf /root/snmpd.log -p /var/run/snmpd.pid -a 2>/root/snmpd.stderr.log
file attached is snmpd.stderr.log

output of
# cat /root/snmpd.log
mibII/mta_sendmail.c:open_sendmailst: could not guess version of statistics file "/var/log/mail/statistics"
NET-SNMP version 5.3.2.2
netsnmp_assert 1 == new_val->high failed int64.c:419 netsnmp_c64_check32_and_update()
c64 32 bit check failed
netsnmp_assert 1 == new_val->high failed int64.c:419 netsnmp_c64_check32_and_update()
c64 32 bit check failed
netsnmp_assert 1 == new_val->high failed int64.c:419 netsnmp_c64_check32_and_update()
c64 32 bit check failed
netsnmp_assert 1 == new_val->high failed int64.c:419 netsnmp_c64_check32_and_update()
c64 32 bit check failed
netsnmp_assert 1 == new_val->high failed int64.c:419 netsnmp_c64_check32_and_update()
c64 32 bit check failed
netsnmp_assert 1 == new_val->high failed int64.c:419 netsnmp_c64_check32_and_update()
c64 32 bit check failed
netsnmp_assert 1 == new_val->high failed int64.c:419 netsnmp_c64_check32_and_update()
c64 32 bit check failed
Received TERM or STOP signal...  shutting down...

Hello Jan Safranek,

I am getting similar log errors as mentioned in the bug #542826
Here are the system details

# yum info net-snmp
Installed Packages
Name       : net-snmp
Arch       : x86_64
Epoch      : 1
Version    : 5.3.2.2
Release    : 9.el5_5.1
Size       : 2.8 M

I know this version is different in release, but I am getting the same error log even with older release version 7.el5_4.2.

I have temporarily disabled snmp (lot of Google Search indicate that this warning can be ignored as it doesnt affect snmp stability)

Thanks and regards,
-Sudhi

(In reply to comment #22)
> Created attachment 448580 [details]
> output of strace -ttt -s 9999 snmpd
> 
> output of strace -ttt -s 9999 snmpd -Lsd -Lf /root/snmpd.log -p
> /var/run/snmpd.pid -a 2>/root/snmpd.stderr.log
> file attached is snmpd.stderr.log
> 

Ouch, it seems I missed '-f' argument - in the log file you provide is just the part before snmpd forks, i.e. nothing interesting. The option disables the fork, snmpd will keep running in foreground and the strace will get everything.

Could you please try it again, strace -ttt -s 9999 snmpd -f -Lsd -Lf /root/snmpd.log -p > /var/run/snmpd.pid -a 2>/root/snmpd.stderr.log ? Thanks in advance!

And yes, the message is pretty harmless, it only indicates that one SNMP counter can provide wrong values, nothing more. The question is, which counter it is and I hope I can find the answer in the full strace output.

Strange, now I can't see that error
I will keep an eye on for this one, and report back as and when I see this error again.

Thanks

-Sudhi

I got strace files in bug #653780 for 'looks like a 64bit wrap, but prev!=new' message. It's private bug and you probably can't access it, let's just hope the cause for the message is the same.

I'll fix it in RHEL 5.7, feel free to reopen this bug if you still can see the message there.

*** This bug has been marked as a duplicate of bug 653780 ***