[rrd-users] Incorrect numbers returned when monitoring network stats at one second intervals
linux at thehobsons.co.uk
Thu Jul 26 14:39:08 CEST 2007
Mark Seger wrote:
>I had actually written this as a postscript to another topic and Alex
>suggested starting another thread, but by then I had already replied.
>Since there were no follow-up replies I was thinking perhaps this note
>got lost in the haze and so I'm reposting is as a new one
It didn't, I posted a reply last Wednesday.
> > It turns out that unlike most systems counters which get updated quite
>> frequently, network counters only get updated about once a second but
>> not exactly once a second! It turns out they get updated every 0.9765
>> seconds. So consider the output of my collection tool at an interval
>> of 0.2 seconds. Just note that in the following format, I'm reporting
>> the aggregate across interfaces while doing a 'ping -f' on one of
>> them. The rates for the different interfaces are being updated at
>> different times and so that why you're seeing the 8M/sec numbers
>> aligning at .208 while the background traffic on a different interface
>> is aligning at .409.
Data snipped. So in summary - the stats are not updated exactly every
second, and different interfaces are updated at different times.
It's well known that if you sample data asynchronously then you will
get this sort of effect unless you sample rate is significantly
different to the data rate. It's somewhat similar to the aliasing
problem when trying to sample a high frequency analogue signal at too
low a sample rate - for example. If you want that sort of precision
then you must synchronise your sampling with the data, or use some
other means (such as averaging or smoothing) to hide the effect.
Sampling every second does not occasionally give you an invalid value
as you suggest - the value it gives is 100% valid, just unexpected !
Just like a lot of 'amateur statistics' manage to come to invalid
conclusions with valid data.
More information about the rrd-users