Telegraf snmp input truncating Counter64 values

[britcey]

Bug report

The SNMP input is truncating large Counter64 values:

$ snmpget -v2c -c community target-host .1.3.6.1.2.1.31.1.1.1.9.6
IF-MIB::ifHCInBroadcastPkts.6 = Counter64: 18446744073708291555

Telegraf output:

interfaceStats,agent_host=target-host,ifIndex=6 ifHCInBroadcastPkts=9223372036854775807i 1483719491000000000

Relevant telegraf.conf:

[[outputs.file]]
  files = ["stdout"]
  data_format = "influx"

[[inputs.snmp]]
  agents = ["target-host"]
  version = 2
  community = "community"
  name = "interfaceStats"
  [[inputs.snmp.table]]
    name = "interfaceStats"
    inherit_tags = ["hostname"]
  [[inputs.snmp.table.field]]
    name = "ifIndex"
    oid = ".1.3.6.1.2.1.2.2.1.1"
    is_tag = true
  [[inputs.snmp.table.field]]
    name = "ifHCInBroadcastPkts"
    oid = ".1.3.6.1.2.1.31.1.1.1.9"

System info:

Telegraf 1.1.1, Oracle Linux Server release 6.8

Steps to reproduce:

This requires a target device that's either very busy or been up long enough so a Counter64 value is close to wrapping.

Expected behavior:

Actual value is sent to Influx.

Actual behavior:

Value is truncated.

[phemmer]

This is a bug/limitation within the telegraf core, and not specific to the snmp input. It seems that during serialization, the value is converted from unsigned 64-bit integer to a signed 64-bit integer. And since the value is greater than the max of a signed 64-bit integer, it sets it to the max possible with this type (9223372036854775807).
Now I'm unsure if this is a bug, or a limitation. The influxdb line protocol does not indicate support for unsigned 64-bit integers. The protocol doc says it supports floats, integers, strings, and bools. But doesn't say anything about signed/unsigned.

[phemmer]

Opened issue for this on influxdb, as it clearly does not support unsigned 64-bit integers. influxdata/influxdb#7801

[britcey]

Ah, missed the fact that InfluxDB itself can't handle uint64.

I think I grabbed my config from one of the issues here

I suspect people either haven't had their counters exceed int64 size or (more likely?) just haven't noticed it's being truncated.

Hopefully this is an easy enough feature to add to InfluxDB - I'm assuming Telegraf serialization will also need to be fixed-up if that happens.

[sparrc]

closing this for now. If InfluxDB support uint64 than we will add support in telegraf as well.

[toni-moreno]

Hi @sparrc , could this issue also affect also to the Windows Performance Counters (win_perf_counters)?
Hi @phemmer , could this issue be bypassed with a single uint64 to float64 transformation?

Thank you very much

[britcey]

@sparrc is InfluxDB the only output officially supported? This is still an issue if anyone's using the SNMP input with an output that supports uint64.

[phemmer]

Well this would be an issue with telegraf in general, not the SNMP input. The SNMP input is passing on the value as the proper type.

[britcey]

True, didn't mean to point fingers specifically at SNMP, though it'll be a common issue with that input.