[mrtg] Graph under reporting utilization

[Steve Shipway]

> I use it to monitor several network links and it works very well for all
but one.
> I am using it to monitor the interface utilization of a
> 1 Gb/s ethernet port on a Cisco 3850 switch and while MRTG does get data
> and creates a graph, I don't believe the data it is presenting is
accurate.

The moment someone says a bandwidth of >100Mbps I immediately want to check
which SNMP version they're using...

> Target[colo-metro-ethernet-utilization]: 50:public at 192.168.198.1:

Oh dear, it looks like you're using SNMPv1.

SNMPv1 uses 16 bit counters, which will wrap around within the normal 5min
polling interval, if the usage is above approx 150Mbps.  You need to use
SNMPv2c, which has 64bit counters that take substantially longer to wrap
around.  Specify it like this:

Target[colo-metro-ethernet-utilization]: 50:public at 192.168.198.1:::::2

This will prevent the wraparound, and you'll get valid data.  Alternatively,
poll every 1min instead of 5min, but that will only raise your problem
threshold up to about 700Mbps and will require you to delete and recreate
your old data file, so better to use SNMPv2.

This is a very common problem with MRTG now that people more commonly have
Gbps links, but stick with the default SNMPv1.

Steve

Steve Shipway
s.shipway at auckland.ac.nz
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 5909 bytes
Desc: not available
URL: <http://lists.oetiker.ch/pipermail/mrtg/attachments/20141104/4f2947b2/attachment.bin>