[mrtg] Strange phantom spikes in graphs

[Matthew Petach]

I've seen this happen all the time when using log file format on busy
systems, though usually my spikes are impossibly large (greater than 4Tbps),
so I have a script that runs periodically and trims down spikes that are
larger than MaxBytes.  For spikes that are less than MaxBytes, though,
I'm at a bit of a loss, since my script wouldn't be able to identify them 
as erroneous.  I think I'd want to run some other tool first to really
verify whether they might be legitimate traffic volumes or not, and
then proceed from there.

Matt

 



----- Original Message ----
From: Steve Shipway <s.shipway at auckland.ac.nz>
To: Ed LaFrance <edl at colocationonline.info>; "mrtg at lists.oetiker.ch" <mrtg at lists.oetiker.ch>
Sent: Wed, September 30, 2009 2:10:34 PM
Subject: Re: [mrtg] Strange phantom spikes in graphs

> I just recently set up MRTG monitoring of one such installation a few
> days ago, and right away I began noticing strange traffic spikes
> appearing on the WAN and trunk router interfaces: sharp, narrow
> spikes of 60Mbps or more once or twice per day, 

Possible causes -

1) You are running MRTG inside a Virtual Machine (Xen, VMware, etc).  These cause clock skew and mess up calculations.  Don't do it.
2) Try running using SNMPv2 and see if this helps (although your traffic does not seem to be high enough for this to be the cause)
3) There really IS this traffic pattern.  Possibly there is a periodic broadcast storm, or ping flood, or huge SNMP traffic to the device, or something.  Unlikely but may be worth checking.
4) There is a fault in your router.  Unlikely.
5) Something else?

Steve

_______________________________________________
mrtg mailing list
mrtg at lists.oetiker.ch
https://lists.oetiker.ch/cgi-bin/listinfo/mrtg