[mrtg] Re: Oddness with MRTG+RRDTOOL

[Alex van den Bogaerdt]

Matt Heckaman wrote:

> I had a router today lose power due to a lose cable (ugh) and it was
> restarted immediately. However, MRTG for some reason jumped the graph up
> to 20 Megabits (it's a T1 router) directly after that outage. I know that
> there was not nearly that much traffic, so I assume it is linked to the
> outage causing something odd. I'm using mrtg 2.8.12 with rrdtool 1.0.25.

Usually this is caused by a reset of the counter (as happened in your case)
together with a missing "MaxBytes[target]: 1544000" equivalent to RRDtool.

> I'm not sure what other information to provide you other than it's getting
> it's information from SNMP on a Cisco 1604 router. If there is more info I
> can provide, please let me know. Has anyone else seen this behaviour, or
> was it a freak incident?

Check the settings on the RRD.  Perhaps you do have that MaxBytes statement
in your config file but for some reason it was not copied to the RRD file.

Start "rrdtool info your.rrd" and look at the following lines:
   ds[x].min = 0.0000000000e+00
   ds[x].max = NaN
The max should be set to something other than NaN or else the following
behaviour will happen inside RRDtool:

time T+00:00   counter = 123456
time T+00:05   counter = 234567
<reset happens>
time T+00:10   counter = 123456

Inbetween times T+00:05 and T+00:10 the counter incremented with
(123456-234567=) -111111.  This is not possible for a counter and an
overflow is assumed.  A counter overflow is compensated for by adding
2^32, so you get an increase of 2^32-111111 = 4,294,856,185 in the last
five minutes.  This is 14,316,187 bytes or 114,529,496 bits.
This is an absurd increase but as no max is set, it is considered valid.
(see the RRDtool tutorial for more in-depth explanation).

Calculating the other way around:  An increase of 20,000,000 bits/sec is
2,500,000 bytes/sec. That is 750,000,000 bytes in five minutes.

2^32 - x = 750,000,000 ==> x = 3,544,967,296

The difference of the last counter before the reset, minus the value of
the counter just after the reset, should thus have been 3.5 gigabyte.

Would that be possible?  Full utilized T1 is 1,544 kbps which is 193 kBps.
It takes 18134 seconds to reach 3.5 gigabytes... Doable, in five hours.

So, after an uptime of five hours and a fully utilized T1, do a reset.
It should give you a similar spike.

regards,
-- 
   __________________________________________________________________
 / alex at slot.hollandcasino.nl                  alex at ergens.op.het.net \
| work                                                         private |
| My employer is capable of speaking therefore I speak only for myself |
+----------------------------------------------------------------------+
| Technical questions sent directly to me will be nuked. Use the list. | 
+----------------------------------------------------------------------+
| http://faq.mrtg.org/                                                 |
| http://rrdtool.eu.org  --> tutorial                                  |
+----------------------------------------------------------------------+

--
Unsubscribe mailto:mrtg-request at list.ee.ethz.ch?subject=unsubscribe
Archive     http://www.ee.ethz.ch/~slist/mrtg
FAQ         http://faq.mrtg.org    Homepage     http://www.mrtg.org
WebAdmin    http://www.ee.ethz.ch/~slist/lsg2.cgi