[rrd-users] troubleshooting low reported values in MRTG/RRDTool

[David Nolan]

On Feb 5, 2008 3:09 PM, David Ball <davidtball at gmail.com> wrote:
> MRTG v.2.15.1
> RRDTool v.1.2.19 (or newer..still trying to see which one is being used)
>
>   I'm having problems troubleshooting an 'issue' I'm having when
> graphing in/out traffic on a GigEth interface on a Juniper router.
> For 99% of the time, it works just fine, but as per the attached .png
> image, there are times when the results MRTG gets are very low for the
> 1st value (inbound traffic).  I am able to monitor the interface's
> traffic in real time and know that it rarely drops below 100Mbps
> sustained, yet for several consecutive 5min readings, MRTG shows
> rather low values.
>   I'm not sure whether this is an RRDtool issue or an MRTG
> issue.....or an issue at all for that matter.  Wasn't sure where else
> to look, so thought I'd try here.


This is a pattern I've seen many times.  In fact I'd wager money that
I know exactly whats going on.

You're collecting from a 32 bit interface counter on the router,
probably ifInOctets (1.3.6.1.2.1.2.2.1.10.*) .   A 32 bit counter,
counting bytes, will roll over in under 5 minutes at approximately
115Mbps of traffic.  (2^32 / 300(seconds) * 8(convert bytes to bits) /
1000000(convert bits to megabits) =~ 114.5).  The result is that when
you collect the next data point you get a value that is only slightly
above the current value, instead of more then 2^32 above the current
value, and you have no way to know the counter rolled, and thus graph
a low value.

The quickest fix for this, if you're only encountering it in a few
places, is collect those devices more frequently.  No need to change
the rrd setup, it will handle aggregating multiple collections
together.  This only works for so long though.  Even if you start
collecting the data once per minute, at about 575Mbps you'll still
roll the counter.)

The correct fix is to use a 64 bit counter, i.e ifHCInOctets
(1.3.6.1.2.1.31.1.1.1.6.*), if thats available.  Most router hardware
should export that OID.  However, be aware that if you just convert
from ifInOctets to IfHCInOctets, and don't have an appropriate max
value configured in RRD, you may get a huge spike on your graph.


-David