[mrtg] MRTG reporting incorrect results

[Cook, Garry]

Well, IIRC, if you are looking at a multilayer switch and monitoring vlans, the traffic being graphed may be the first packet in each flow. Once flows are established, additional packets are checked against the flow-cache and then switched in hardware, so they wouldn't be seen by SNMP counters at layer 3.
However, I think this may be the answer to a different question, such as "Why does the uplink graph not show all of the traffic?" It seems to me that your issue might be different, although you might want to consider the above in your troubleshooting.

If this just started occurring one day, then I would think that something somewhere must have changed.
I back up all of my configs using a shell script and TFTP server once a day. Additionally, NeDi tracks config changes on all of my devices. I know that a lot of people also recommend Rancid for this type of thing. You mentioned restoring from backup, although I'm not sure if you meant MRTG, the switch, or both. If you know exactly when the issue began, you should diff the MRTG and/or switch configs from the day before and the day after, and see what changes might have occurred.
Are you the only one with access to the devices? Or could someone else have possibly made a change without you being aware?

Thanks,
Garry

-----Original Message-----
From: Patrick Kremer [mailto:patrick at nicsys.net]
Sent: Monday, November 05, 2007 9:45 AM
To: Cook, Garry; mrtg at lists.oetiker.ch
Subject: RE: [mrtg] MRTG reporting incorrect results

They are layer 3 Dell power connect 5324 switches. All 3 have 2 uplinks plugged into 2 cisco PIXs in failover mode. The one in question has ports split up into separate VLANS.

The thing is MRTG was working just fine until about 3 weeks ago when the behavior started. No config changes to the switch or the MRTG file, I even restored from backup just to be sure.

Since MRTG seems to working on the other switches, the traffic must be legitimate somehow.

-----Original Message-----
From: "Cook, Garry" <Garry.Cook at arcadis-us.com>
To: "Patrick Kremer" <patrick at nicsys.net>; "Mersberger, Robert" <robert.mersberger at goldenven.com>; "mrtg at lists.oetiker.ch" <mrtg at lists.oetiker.ch>
Sent: 11/5/07 9:01 AM
Subject: RE: [mrtg] MRTG reporting incorrect results

Have you mentioned what type of switch this is? Also, what is its function? Layer 3 or layer 2 switch? Give up some details Man...

While I wouldn't have arrived at the bad hardware conclusion, I don't think there is anything 'wrong' with your MRTG installation, so this may still be OT. However, the saving grace could be in the details of your switch config. I haven't done any L3 switching in a while, but I remember from a few years back that I had similar issues when attempting to graph this type of data with MRTG.

Thanks,
Garry

[snip]
This apparently started happening 2 weeks ago. All MRTG-monitored interfaces on one particular switch are showing identical graphs for all "Out" bandwidth. As expected, the report shows varying values for "In" Max/Average/Current for each port on the switch. However, each port has the exact same values for all "Out" Max/Average/Current. The blue line is exactly the same for all ports on all graphs beginning between at about week 41 1/2.  Obviously, this isn't possible

It doesn't appear to be something specifically wrong with MRTG itself because the rest of the monitored switches seem to be reporting correctly. The MRTG config for the switch in question hasn't changed in 3 months. I have already tried rebooting the switch and the machine hosting MRTG. Because I couldn't think of anything else to do, I tried regenerating the configuration file with an snmpwalk, but it's no different from the original config file

NOTICE: This e-mail and any files transmitted with it are the property of ARCADIS U.S., Inc. and its affiliates. All rights, including without limitation copyright, are reserved. The proprietary information contained in this e-mail message, and any files transmitted with it, is intended for the use of the recipient(s) named above. If the reader of this e-mail is not the intended recipient, you are hereby notified that you have received this e-mail in error and that any review, distribution or copying of this e-mail or any files transmitted with it is strictly prohibited. If you have received this e-mail in error, please notify the sender immediately and delete the original message and any files transmitted. The unauthorized use of this e-mail or any files transmitted with it is prohibited and disclaimed by ARCADIS U.S., Inc. and its affiliates.