[rrd-users] Re: Spikes

[Gellatly, Laurie (x8864)]

Hi.
I've seen a problem here that may be related to this.
I decided to draw a line at the maximum bandwidth for my
serial links. I then saw a serial link, run by a CISCO 7500 was,
according to IfOutOctets, pushing more data down a link than
the physical bandwidth! Neat trick. The duration of the "spikes"
were up to an hour, so it was not just a single wrong value.
The other end of the link, a CISCO 4500, shows a more believable 
presentation. It appears that the 7500 is doing some double 
counting of out going packets when it comes under load. 
Any one else seen this behaviour?

In the process of trying to rationalise this with CISCO 
over the last 2-3 months, at one stage they thought I
may have been using their 5 minute sliding average which runs
an algorithm that, they claim, is unbounded (i.e. can produce 
figures greater than the actual bandwidth)!! 
Conclusions :
1) I can not imagine any reason why I would now ever want to use 
these 5 minute figures produced from the CISCO and would hope that
nobody from this group is using them either.
2) It appears to me that the IfOutOctets counter for some CISCO
routers is useless in some instances. Be warned. 

                         ...Laurie :{)
Network Vodafone - Network Management
*:+61 2 9425 8864
* :+61 2 9425 8823
M:+61 416 11 44 19
*:laurie.gellatly at vodafone.com.au




-----Original Message-----
From: Daniel Rinehart [mailto:danielr at ccs.neu.edu]
Sent: Sunday, 5 December 1999 15:00
To: Alex van den Bogaerdt
Cc: RRD users
Subject: [rrd-users] Re: Spikes


> This looks like a reset to me, not a wrap.  Not sure about the 8510 but
> on the 5500 series the snmp counters will reset too when you issue a
> clear counters command from the prompt.
> Unfortunately the snmp uptime is *not* reset when doing this ...

	Looks like I'll need to talk to Cisco on Monday then, because I'm
not issuing a clear at all. I've also since observed this odd wrapping
behavior just watching the output of 'show interface' without SNMP
involved. At least, the interface isn't saying I am (output of sh int atm
0/0/1):

  Last clearing of "show interface" counters never
  Queueing strategy: fifo
  Output queue 0/40, 0 drops; input queue 0/75, 0 drops
  5 minute input rate 0 bits/sec, 0 packets/sec
  5 minute output rate 0 bits/sec, 0 packets/sec
     17581 packets input, 931793 bytes, 0 no buffer

> delta should be 4291541058. That's 4,291,541,058.  Divided by 300 (5min)
> you should get a spike with size 14M.  Correct?

	Yup. The are always in the range of 14-15M. This is a dump of the
"spiked" section from the RRD database, as generated from the data posted
in my earlier message:

<!-- 1999-12-04 06:45:00 EST --> <row><v> 1.0106976708e+02 </v></row>
<!-- 1999-12-04 06:50:00 EST --> <row><v> 9.4598140716e+01 </v></row>
<!-- 1999-12-04 06:55:00 EST --> <row><v> 1.0237584918e+02 </v></row>
<!-- 1999-12-04 07:00:00 EST --> <row><v> 1.4162561428e+07 </v></row>
<!-- 1999-12-04 07:05:00 EST --> <row><v> 1.4268386264e+05 </v></row>
<!-- 1999-12-04 07:10:00 EST --> <row><v> 1.0373755191e+02 </v></row>
<!-- 1999-12-04 07:15:00 EST --> <row><v> 1.0108732455e+02 </v></row>

- Daniel R. <danielr at ccs.neu.edu> [http://www.ccs.neu.edu/home/danielr/]

--
* To unsubscribe from the rrd-users mailing list, send a message with the
  subject: unsubscribe to rrd-users-request at list.ee.ethz.ch



---------------------------------------------------------------------
This correspondence is for the named person's use only.  It may 
contain confidential or legally privileged information or both. 
No confidentiality or privilege is waived or lost by any 
mistransmission.  If you receive this correspondence in error, please
immediately delete it from your system and notify the sender.  You 
must not disclose, copy or rely on any part of this correspondence 
if you are not the intended recipient. 

Any views expressed in this message are those of the individual sender,
except where the sender expressly, and with authority, states them to
be the views of Vodafone.

This email has been checked for viruses.

--
* To unsubscribe from the rrd-users mailing list, send a message with the
  subject: unsubscribe to rrd-users-request at list.ee.ethz.ch