19142 FIX Fix incorrect memory usage on ArubaOS-CX switches

SUP-29474

Change-Id: I0aaaa8786f271894706ad2f0c13c800a04ed6162

Author: NotANormalNerd

.werks/19142.md

@@ -0,0 +1,22 @@
+[//]: # (werk v3)
+# Fix incorrect memory usage on ArubaOS-CX switches
+
+key        | value
+---------- | ---
+date       | 2026-07-23T12:00:45.337909+00:00
+version    | 3.0.0b1
+class      | fix
+edition    | community
+component  | checks
+level      | 1
+compatible | yes
+
+Previously, the _Memory_ service could report an incorrect memory usage on
+ArubaOS-CX / HPE Aruba Networking switches, where the summary looked like this:
+
+_Total (RAM + Swap): -7.54% - -573 MiB of 7.42 GiB RAM_
+
+This happened because these switches already exclude cached memory from the
+reported usage, while Checkmk subtracted it once more. This has been fixed.
+These switches now report the correct memory usage automatically, without any
+configuration.

cmk/plugins/hr/agent_based/hr_mem.py

@@ -95,7 +95,37 @@ def to_bytes(units: str) -> int:
     return parsed
 
 
-def aggregate_meminfo(parsed: PreParsed) -> memory.SectionMemUsed:
+# The "Physical memory" hrStorageUsed value is normally interpreted as
+# INCLUDING the reclaimable page cache (classic net-snmp / UCD, which reports
+# "MemTotal - MemFree"). Checkmk therefore subtracts the "Cached memory" entry
+# to obtain the real usage.
+#
+# ArubaOS-CX switches (HPE Aruba Networking) instead report the physical "used"
+# value with the cache already excluded (modern net-snmp "MemAvailable"
+# semantics), while still exposing a large "Cached memory" entry. There the
+# cached memory can exceed the reported "used" value, and subtracting it would
+# understate the usage or even push it below zero. The two cases cannot be told
+# apart from the HOST-RESOURCES-MIB values alone (RFC 2790 defines no
+# relationship between storage entries), so these devices are recognized by
+# their sysObjectID, which lives under the Aruba (enterprise 47196) wired switch
+# product arc, e.g. ...47196.4.1.1.1.100 (6300M) or ...4.1.1.1.309 (6200F).
+_CACHE_EXCLUDED_FROM_USED_SYS_OBJECT_IDS: tuple[str, ...] = (
+    ".1.3.6.1.4.1.47196.4.1.1.1.",  # ArubaOS-CX switches (SUP-29474)
+)
+
+
+def _reports_cache_excluded_from_used(system_info: StringTable) -> bool:
+    """Whether the device's SNMP agent reports the physical memory usage with the
+    page cache already excluded (so the cache must not be subtracted again)."""
+    if not system_info or not system_info[0]:
+        return False
+    sys_object_id = system_info[0][0]
+    return any(
+        sys_object_id.startswith(prefix) for prefix in _CACHE_EXCLUDED_FROM_USED_SYS_OBJECT_IDS
+    )
+
+
+def aggregate_meminfo(parsed: PreParsed, *, subtract_cache: bool = True) -> memory.SectionMemUsed:
     """return a meminfo dict as expected by check_memory from mem.include"""
     meminfo: memory.SectionMemUsed = {"Cached": 0}
 
@@ -115,7 +145,7 @@ def aggregate_meminfo(parsed: PreParsed) -> memory.SectionMemUsed:
                     meminfo.setdefault("SwapTotal", size)
                     meminfo.setdefault("SwapFree", (size - used))
 
-            if descr == "cached memory" and used > 0:
+            if subtract_cache and descr == "cached memory" and used > 0:
                 # Account for cached memory (this works at least for systems using
                 # the UCD snmpd (such as Linux based applicances)
                 # some devices report negative used cache values...
@@ -132,7 +162,10 @@ def parse_hr_mem(string_table: Sequence[StringTable]) -> memory.SectionMemUsed |
     if not any(size > 0 for _, size, __ in pre_parsed.get("RAM", [])):
         return None
 
-    section = aggregate_meminfo(pre_parsed)
+    system_info = string_table[1] if len(string_table) > 1 else []
+    subtract_cache = not _reports_cache_excluded_from_used(system_info)
+
+    section = aggregate_meminfo(pre_parsed, subtract_cache=subtract_cache)
     return section if section.get("MemTotal") else None
 
 
@@ -151,6 +184,12 @@ def parse_hr_mem(string_table: Sequence[StringTable]) -> memory.SectionMemUsed |
                 "6",  # hrStorageUsed
             ],
         ),
+        SNMPTree(
+            base=".1.3.6.1.2.1.1",
+            oids=[
+                "2.0",  # sysObjectID
+            ],
+        ),
     ],
     detect=ucd_hr_detection.USE_HR_MEM,
 )

tests/unit/cmk/plugins/hr/agent_based/test_hr_mem.py

@@ -159,6 +159,54 @@ def test_hr_mem(
     assert hr_mem.pre_parse_hr_mem(string_table) == expected_parsed_data
 
 
+# hrStorageUsed of the "Physical memory" entry (1602976) is smaller than the
+# "Cached memory" entry (2190028) - i.e. the device reports "used" with the
+# cache already excluded. Data taken from a real ArubaOS-CX switch (SUP-29474).
+_ARUBA_HR_STORAGE: StringTable = [
+    [".1.3.6.1.2.1.25.2.1.2", "Physical memory", "1024", "7784284", "1602976"],
+    [".1.3.6.1.2.1.25.2.1.1", "Cached memory", "1024", "2190028", "2190028"],
+]
+
+
+# Real ArubaOS-CX sysObjectIDs from SUP-29474: JL658A 6300M and JL728B 6200F.
+_ARUBA_SYS_OBJECT_IDS = [".1.3.6.1.4.1.47196.4.1.1.1.100", ".1.3.6.1.4.1.47196.4.1.1.1.309"]
+
+
+@pytest.mark.parametrize("sys_object_id", _ARUBA_SYS_OBJECT_IDS)
+def test_reports_cache_excluded_from_used_aruba(sys_object_id: str) -> None:
+    assert hr_mem._reports_cache_excluded_from_used([[sys_object_id]])
+
+
+def test_reports_cache_excluded_from_used_other_devices() -> None:
+    # net-snmp / UCD device -> "used" includes the cache -> must not match.
+    assert not hr_mem._reports_cache_excluded_from_used([[".1.3.6.1.4.1.8072.3.2.10"]])
+    assert not hr_mem._reports_cache_excluded_from_used([])
+    assert not hr_mem._reports_cache_excluded_from_used([[]])
+    assert not hr_mem._reports_cache_excluded_from_used([[""]])
+
+
+def test_parse_hr_mem_subtracts_cache_by_default() -> None:
+    # Unknown device -> classic net-snmp interpretation -> cache is subtracted.
+    section = hr_mem.parse_hr_mem([_ARUBA_HR_STORAGE, [[".1.3.6.1.4.1.8072.3.2.10"]]])
+    assert section is not None
+    assert section["Cached"] == 2190028 * 1024
+
+
+@pytest.mark.parametrize("sys_object_id", _ARUBA_SYS_OBJECT_IDS)
+def test_parse_hr_mem_keeps_cache_for_cache_excluded_devices(sys_object_id: str) -> None:
+    # Recognized ArubaOS-CX device -> cache must not be subtracted.
+    section = hr_mem.parse_hr_mem([_ARUBA_HR_STORAGE, [[sys_object_id]]])
+    assert section is not None
+    assert section["Cached"] == 0
+
+
+def test_parse_hr_mem_without_system_info_subtracts_cache() -> None:
+    # No sysObjectID fetched (e.g. old cached data) -> keep classic behavior.
+    section = hr_mem.parse_hr_mem([_ARUBA_HR_STORAGE])
+    assert section is not None
+    assert section["Cached"] == 2190028 * 1024
+
+
 if __name__ == "__main__":
     # Please keep these lines - they make TDD easy and have no effect on normal test runs.
     # Just run this file from your IDE and dive into the code.