[mrtg] MRTG reporting incorrect results

[Patrick Kremer]

You have a point there.

I replaced the switch in question and am getting exactly the same results - all interfaces report the same Out bandwidth. To be more accurate, all the ports connected to servers report the same Out bandwidth. The uplink ports to the router are reporting different numbers.

I directed a flood of pings to an IP on each port, I varied the duration of the ping flood between 2-4 minutes, and looked at the MRTG graph after each flood. In all cases, every port reported the same jump in the OUT bandwidth despite the fact that I specifically directed a flood of traffic to an IP behind a single port. Just to test my own sanity, I did this on other switches and got the expected result of a jump in bandwidth only on the specific port that "owned" the IP.

I watched the ARP debug logs and didn't seem to find anything unusual.  I'm not sure where else to go from here but it doesn't really seem to be an MRTG problem at this point.

----- Original Message ----- 
  From: Matthew Petach 
  To: Patrick Kremer 
  Sent: Sunday, November 04, 2007 2:47 PM
  Subject: Re: [mrtg] MRTG reporting incorrect results



  You say "Obviously this isn't possible" -- actually, if the MAC address table in your
  switch dies/fails to populate for some reason, the normal behaviour is for the switch
  to become a hub, and flood all unknown unicast traffic out to all ports; which means
  you'll see exactly that pattern, the inbound on each port is correct, but all traffic from
  all ports is flooded out to all other ports, giving you the results you're seeing, where
  the outbound data on all ports is identical.

  Matt


  ----- Original Message ----
  From: Patrick Kremer <patrick at nicsys.net>
  To: mrtg at lists.oetiker.ch
  Sent: Friday, November 2, 2007 12:07:11 PM
  Subject: [mrtg] MRTG reporting incorrect results


  This apparently started happening 2 weeks ago. All MRTG-monitored interfaces on one particular switch are showing identical graphs for all "Out" bandwidth. As expected, the report shows varying values for "In" Max/Average/Current for each port on the switch. However, each port has the exact same values for all "Out" Max/Average/Current. The blue line is exactly the same for all ports on all graphs beginning between at about week 41 1/2.  Obviously, this isn't possible

  It doesn't appear to be something specifically wrong with MRTG itself because the rest of the monitored switches seem to be reporting correctly. The MRTG config for the switch in question hasn't changed in 3 months. I have already tried rebooting the switch and the machine hosting MRTG. Because I couldn't think of anything else to do, I tried regenerating the configuration file with an snmpwalk, but it's no different from the original config file.

  I don't know what else to do except assume that I somehow have a bad switch?? Has anybody come across anything like this before?



  __________________________________________________
  Do You Yahoo!?
  Tired of spam? Yahoo! Mail has the best spam protection around 
  http://mail.yahoo.com 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.oetiker.ch/pipermail/mrtg/attachments/20071105/c3370eca/attachment-0001.html