[rrd-users] troubleshooting low reported values in MRTG/RRDTool

[David Ball]

  Thanks for the swift and informative reply.  I've converted this
particular Target to SNMPv2c in order to get the ifHC* counters, and
will monitor to see if things clear up.  I verfied that the device
does support ifHC* counters.
  Thanks again!

David


On 05/02/2008, David Nolan <vitroth at cmu.edu> wrote:
> On Feb 5, 2008 3:09 PM, David Ball <davidtball at gmail.com> wrote:
> > MRTG v.2.15.1
> > RRDTool v.1.2.19 (or newer..still trying to see which one is being used)
> >
> >   I'm having problems troubleshooting an 'issue' I'm having when
> > graphing in/out traffic on a GigEth interface on a Juniper router.
> > For 99% of the time, it works just fine, but as per the attached .png
> > image, there are times when the results MRTG gets are very low for the
> > 1st value (inbound traffic).  I am able to monitor the interface's
> > traffic in real time and know that it rarely drops below 100Mbps
> > sustained, yet for several consecutive 5min readings, MRTG shows
> > rather low values.
> >   I'm not sure whether this is an RRDtool issue or an MRTG
> > issue.....or an issue at all for that matter.  Wasn't sure where else
> > to look, so thought I'd try here.
>
>
> This is a pattern I've seen many times.  In fact I'd wager money that
> I know exactly whats going on.
>
> You're collecting from a 32 bit interface counter on the router,
> probably ifInOctets (1.3.6.1.2.1.2.2.1.10.*) .   A 32 bit counter,
> counting bytes, will roll over in under 5 minutes at approximately
> 115Mbps of traffic.  (2^32 / 300(seconds) * 8(convert bytes to bits) /
> 1000000(convert bits to megabits) =~ 114.5).  The result is that when
> you collect the next data point you get a value that is only slightly
> above the current value, instead of more then 2^32 above the current
> value, and you have no way to know the counter rolled, and thus graph
> a low value.
>
> The quickest fix for this, if you're only encountering it in a few
> places, is collect those devices more frequently.  No need to change
> the rrd setup, it will handle aggregating multiple collections
> together.  This only works for so long though.  Even if you start
> collecting the data once per minute, at about 575Mbps you'll still
> roll the counter.)
>
> The correct fix is to use a 64 bit counter, i.e ifHCInOctets
> (1.3.6.1.2.1.31.1.1.1.6.*), if thats available.  Most router hardware
> should export that OID.  However, be aware that if you just convert
> from ifInOctets to IfHCInOctets, and don't have an appropriate max
> value configured in RRD, you may get a huge spike on your graph.
>
>
> -David
>
> _______________________________________________
> rrd-users mailing list
> rrd-users at lists.oetiker.ch
> https://lists.oetiker.ch/cgi-bin/listinfo/rrd-users
>