[rrd-users] Re: odd spikes due to early resets

[Clifton Royston]

On Mon, Feb 19, 2001 at 11:22:42AM -0400, Matt Ashfield wrote:
> I'm graphing the In & Out traffic over my router interfaces.
> 
> I'm seeing some odd spikes in my graphs, exceeding what would be the
> maximum traffic (if I had defined a Max, which I did not) for that
> interface over my specified sample time (15 minutes).
> 
> Upon further investigation, it seems that my counters are being reset
> early, rather than at 4294967296 as it should. What results is a
> massively large spike in my graph.

Usually this results from routers which incorrectly implement a "clear
counters" command to clear the actual SNMP counters for the interface,
insteaad of just clearing them for display purposes.

If you're using Ciscos, this problem seems to keep coming and going
with different IOS releases.

> Has anyone else experienced these problems? 

Nearly everyone.

> If so, what are you doing
> to combat it?

Data storage side - set the RRD max to the speed of the interface
instead of leaving it unset; if the interface speed is high, set a
realistic max for real traffic (and accept that this might cause the
loss of data or "invisibility" of genuine peaks); switch to DERIVE,
again set a realistic max, and also set an RRD min of 0, which will
eliminate a larger range of value changes (whenever it goes negative)
at the cost of losing all genuine counter wraps.

Operations side - Try to convince your operators to not use "clear
counters" on routers, switches, or other devices which are subject to
this problem.

  -- Clifton

-- 
 Clifton Royston  --  LavaNet Systems Architect --  cliftonr at lava.net
                  "WWJD?  JWRTFM!" - Scott Dorsey (kludge)

--
Unsubscribe mailto:rrd-users-request at list.ee.ethz.ch?subject=unsubscribe
Help        mailto:rrd-users-request at list.ee.ethz.ch?subject=help
Archive     http://www.ee.ethz.ch/~slist/rrd-users
WebAdmin    http://www.ee.ethz.ch/~slist/lsg2.cgi