[mrtg] Re: Introduction and Question

[PAUL WILLIAMSON]

>>> "Berger, Gary" <GARY.BERGER at odnss.com> 08/11/06 12:58 PM >>>
> I have used MRTG for network monitoring in one form or another for 
> about 12 years.  
 
Wow, you must have been among the first users...it only was 
made public in '96... ;)

Anyway, on to your questions...

> Now, my question; we are monitoring our 25 locations from a 
> data center in Atlanta.  Our latency to varies from between 30ms 
> to 55ms depending on the location.  We currently have our polling 
> interval set to 5 minutes which I believe is the default.  

Yep, sure is...and the lowest resultion currently supported using 
MRTG as the poller.  There are hacks to get this lower, but it 
is not recommended for the reasons below.

> Of course this is controlled by Cron (we are running on Linux).  

Why "of course"?  You can 'daemonize' mrtg and don't have to put 
it in cron.  The downside is that each time you change the 
config, you'll need to restart the daemon.

> Is it reasonable for me to think that I can set the polling 
> interval to 5 seconds and get a good response?  

No.  Especially not with just using MRTG.  If you switch 
to RRDTool for the backend, then set up your own poller 
(a number of pre-built ones are available like routers, mrtg-rrd, 
cacti and cricket to name a few), you'll get the information
desired.  But, in polling on a 5 second interval, you'll introduce 
a ton of interpolation because RRDTool will attempt to 
"normalize" the data obtained.  On a 5 minute interval, a 1 
second delay is not that big of a deal.  On a 5 second interval, 
a 1 second delay would have a potentially astronomical effect 
on the data collected.  That is not even taking into account 
the delay from the snmp process on the device giving you the 
requested information.

> My experience in general has been that getting results 
> back from the SNMP queries of the routers takes longer 
> than this.  Net/net I end up with missed samples etc.

Yep, exactly.  You may end up getting a whole lot of NaN 
results in your 5 second rra.

> If this is not reasonable, can you recommend a tool 
> that can help me get this level of granularity on network 
> performance?  My suspicion is that I will need to take a 
> distributed approach placing an MRTG box at every
> location and have it watch the WAN port for that location.  

You'll still have the same problem.  The devices won't be 
able to keep up with the requests.  And since (hopefully) 
snmp is at the bottom of the priority queue, even below 
icmp, your snmp statistics will be totally unusable.

> With this approach is it reasonable for me to expect a 
> polling interval of 5 seconds to be successful?
 
No.  You may be able to stick some device in between 
or on the same vlan that just collected the traffic 
and can respond, but that is doubtful as well.  The only 
product I've seen that does a resonably close job 
of real-time monitoring are Visual Networks CSUs.  Even 
then, you'll still end up with some missed polls, and those 
devices are in-line with the traffic, capturing everything 
that hits the WAN interface of the router, so you aren't 
adding anything at all to the router - it just costs lots 
of money.

Paul

--
Unsubscribe mailto:mrtg-request at list.ee.ethz.ch?subject=unsubscribe
Archive     http://lists.ee.ethz.ch/mrtg
FAQ         http://faq.mrtg.org    Homepage     http://www.mrtg.org
WebAdmin    http://lists.ee.ethz.ch/lsg2.cgi