[rrd-users] Incorrect numbers returned when monitoring network stats at one second intervals

[Simon Hobson]

Mark Seger wrote:

>I had actually written this as a postscript to another topic and Alex
>suggested starting another thread, but by then I had already replied. 
>Since there were no follow-up replies I was thinking perhaps this note
>got lost in the haze and so I'm reposting is as a new one

It didn't, I posted a reply last Wednesday.

>  > It turns out that unlike most systems counters which get updated quite
>>  frequently, network counters only get updated about once a second but
>>  not exactly once a second!  It turns out they get updated every 0.9765
>>  seconds.  So consider the output of my collection tool at an interval
>>  of 0.2 seconds.  Just note that in the following format, I'm reporting
>>  the aggregate across interfaces while doing a 'ping -f' on one of
>>  them.  The rates for the different interfaces are being updated at
>>  different times and so that why you're seeing the 8M/sec numbers
>>  aligning at .208 while the background traffic on a different interface
>>  is aligning at .409.

Data snipped. So in summary - the stats are not updated exactly every 
second, and different interfaces are updated at different times.

It's well known that if you sample data asynchronously then you will 
get this sort of effect unless you sample rate is significantly 
different to the data rate. It's somewhat similar to the aliasing 
problem when trying to sample a high frequency analogue signal at too 
low a sample rate - for example. If you want that sort of precision 
then you must synchronise your sampling with the data, or use some 
other means (such as averaging or smoothing) to hide the effect.

Sampling every second does not occasionally give you an invalid value 
as you suggest - the value it gives is 100% valid, just unexpected ! 
Just like a lot of 'amateur statistics' manage to come to invalid 
conclusions with valid data.