[mrtg] cisco switches, etherchannel, and artificially low graph values?

Fri Mar 21 16:30:57 CET 2008

Matt,

It looks like your config is not using the 64bit counters but the 32bit counters. At about 114Mbits/s the 32bit counters roll over once per 5 minutes. MRTG can deal with one roll over per interval but there is no way to deal with multiple roll overs.
Resent versions of MRTG detect the availability of the ifHC* (i.e. 64bit) counters. In the older versions you need to specify the usage of the 64bit counters in the cfgmaker command: --snmp-options=:::::2
You can also manualy add the :::::2 at the end of the targetlines in the mrtg cfg file to get the 64bit counters.

An other possibility is that the ifIndex for the specific port has changed, and now you are looking at an graph with figures from an other port. This can easily happen after changes in the configuration. 
To fix an interface to one graph you can add '--ifref=name' or '--ifref=descr' in the cfgmaker command.

HTH,

Jan.

	-----Original Message-----
	From: mrtg-bounces at lists.oetiker.ch [mailto:mrtg-bounces at lists.oetiker.ch] On Behalf Of Kettler, Matt
	Sent: Friday, March 21, 2008 3:48 PM
	To: mrtg at lists.oetiker.ch
	Subject: [mrtg] cisco switches, etherchannel,and artificially low graph values?

	I've got an odd problem with my interface graphs never reaching their proper peak.. They all seem to be scaled down inappropriately.

	For starters, I've pointed cfgmaker at a variety of ordinary Cisco switches.  I'll be using examples from a Cisco 4948 running  12.2(20r)EW1, but I've seen the same affects on 3750's 12.2(25r)SE1.

	I've got MRTG running in daemon mode at 5 minute intervals.

	When I run cfgmaker, I use this basic form:

	cfgmaker --global 'WorkDir: /var/mrtg/work' --global 'Options[_]:bits,growright' --global 'WithPeak[_]: wmy' --no-down --show-op-down --output  switchname.cfg community at switchname

	This generates me a nice little switchname.cfg file, so far so good.

	It properly adds the global Options[_]: bits, growright, which makes MRTG graph in bits, not bytes, which I prefer, etc..

	Cfgmaker generates an entry for each port (ie: gi1/3, gi1/4), and one for the combined port (ie: po7). However, MRTG seems to handle the combined ports strangely.

	This particular example is a 2gbit/sec LACP port made of 2 gig-e interfaces. cfgmaker understands this port and generated:

	MaxBytes[switch_96]: 250000000

	And pagetop contains:

	                                        <td>Max Speed:</td>

	                                        <td>2000.0 Mbits/s</td>

	Which is all as it should be. When MRTG runs, it generates the graphs which claim to be in bits, but the values never reach as high as they should.

	When I log into the switch and use sho int I get:

	5 minute output rate 208729000 bits/sec, 17265 packets/sec

	That's 208mbit/sec, or perhaps 199 mbit/sec if you count by 1024's. This is a port to my backup server, and it sustains rates around 300-500mbit/sec pretty readily.

	However, MRTG is reporting this on the daily graph:

	            Max      Average             Current

	Out       143.0 Mb/s (0.9%)         23.9 Mb/s (0.1%)           75.1 Mb/s (0.5%)

	Earlier I had the switch reporting 463mbit/sec for an extended period of time, and I've not gotten a report out of the switch below 200mbit/sec in repeated queries over the past hour minutes or so. However, even the 24hr max doesn't line up with my current measurements.....

	Both are operating on 5 minute averages, and the load is fairly sustained, so why the low numbers in MRTG?

	Also, in the same graph update MRTG reports:

	                                    Max      Average             Current

	Gi1/3                Out       106.8 Mb/s (1.3%)         18.9 Mb/s (0.2%)           96.3 Mb/s (1.2%)

	Gi1/4                Out       165.6 Mb/s (2.1%)         16.7 Mb/s (0.2%)           46.7 Mb/s (0.6%) 

	Po7                  Out       143.0 Mb/s (0.9%)         24.3 Mb/s (0.2%)           46.2 Mb/s (0.3%)

	How does an etherchannel have a lower current output rate than either of its children?

	Is there a known issue on cisco switches and their reporting of etherchannel interfaces over SNMP?

	In general I seem to be having anomalous numbers on all my switch ports, but they're most noticeable on etherchannels

_________________________________________________________

Dit bericht kan informatie bevatten die niet voor u is bestemd. 
Indien u niet de geadresseerde bent of dit bericht abusievelijk aan u is toegezonden, 
wordt u verzocht dat aan de afzender te melden en het bericht te verwijderen. 
De staat aanvaardt geen aansprakelijkheid voor schade, van welke aard ook, 
die verband houdt met risico's verbonden aan het elektronisch verzenden van berichten.
_________________________________________________________

This message may contain information that is not intended for you. 
If you are not the addressee or if this message was sent to you by mistake, 
you are requested to inform the sender and delete the message. 
The state accepts no liability for damage of any kind resulting from the risks 
inherent in the electronic transmission of messages.
_________________________________________________________
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.oetiker.ch/pipermail/mrtg/attachments/20080321/7413b188/attachment-0001.html 