Strange graphing in fast interfaces

A7V

06-08-2004 09:51:32

I'm having very strange graphing in fast interfaces, specifically 100+ mbit interfaces.
MRTG is able to gather/graph correctly as can be seen in the following 2 graphs for the same interface
NetMRG
[img615542e045]http//pwp.netcabo.pt/maxxx/netmrg/br01pc05-sr01pc02-netmrg.png[/img615542e045]
MRTG
[img615542e045]http//pwp.netcabo.pt/maxxx/netmrg/br01pc05-sr01pc02-mrtg.png[/img615542e045]

Looking at the 2 monitors for this interface
Interfaces - Bytes Out
Value 2.29 G
Rate of Change 2.67 M
Time Stamp 2004-08-06 144501

Interfaces - Bytes In
Value 2.24 G
Rate of Change -51447.39
Time Stamp 2004-08-06 144501

My idea is that there is a rollover in the counter and so the count will be messed up roll

I can provide more info if requested.

balleman

06-08-2004 13:12:46

Are you using 64-bit counters? NetMRG doesn't do that out-of-the-box, but it isn't hard to make the modifications on your installation. We may have posted about that here before, but if not, reply and we'll walk through it.

Another possibility is the maximum values configured for the monitors, but you've probably already checked those.

A7V

06-08-2004 20:20:08

Before seeing your reply I was already testing 64bit counters and that resolved my problem D
I created 2 new SNMP tests

Interfaces - Bytes in 64bit ifHCInOctets.%ifIndex%
Interfaces - Bytes out 64bit ifHCOutOctets.%ifIndex%

Now I'm able to see 360mbits graphed ok twisted

hosierd

18-08-2004 13:42:23

Could you walk me through this? I tried following the example given in another post called 64-bit counters but now I'm not showing any data in my graphs.

[quote938a02bb85="balleman"]Are you using 64-bit counters? NetMRG doesn't do that out-of-the-box, but it isn't hard to make the modifications on your installation. We may have posted about that here before, but if not, reply and we'll walk through it.

Another possibility is the maximum values configured for the monitors, but you've probably already checked those.[/quote938a02bb85]

balleman

18-08-2004 13:51:59

Before we walk thru it, could you check to see if you have NetMRG configured to use SNMPv2 for the device? ("Edit" the device to check).

hosierd

18-08-2004 14:10:56

The devices I'm monitoring are 3rd generation Enterasys smart switche E6/E7 switches. They only support snmp v1

[quoted5ab5d6b7f="balleman"]Before we walk thru it, could you check to see if you have NetMRG configured to use SNMPv2 for the device? ("Edit" the device to check).[/quoted5ab5d6b7f]

balleman

18-08-2004 14:28:39

My understanding is that the Counter64 data type is only supported in SNMP v2 and v3. Since a 64 bit counter probably won't be available, another alternative is running the gatherer process more frequently. You don't need to alter the configuration file, just change the */5 to a */2 or * in your crontab. Hopefully this will clear up your problems.

Good luck, and let us know how it works out.

hosierd

18-08-2004 14:43:10

Since I wanted to poll every minute, to better capture and reflect bursty traffic, my cron entry has always been

* * * * * /usr/local/bin/netmrg_cron.sh


[quote66c1b4aa93="balleman"]My understanding is that the Counter64 data type is only supported in SNMP v2 and v3. Since a 64 bit counter probably won't be available, another alternative is running the gatherer process more frequently. You don't need to alter the configuration file, just change the */5 to a */2 or * in your crontab. Hopefully this will clear up your problems.

Good luck, and let us know how it works out.[/quote66c1b4aa93]

balleman

18-08-2004 14:45:09

Oh. I'm not sure what to suggest then. Are other pollers like MRTG able to successfully graph your interfaces? Feel free to post a graph that demonstrates your problems as well.

hosierd

11-01-2005 18:49:46

After a rather lengthy review I now have questions/concerns about the data & graphs being generated for my 100 & 1000 mbps interfaces. I run MRTG v 2.100001, RRD Tool v1.0.48, and 14all.cgi v1.1p25 on the same box as NetMRG ( v0.17).

As a test I've had MRTG and NETMRG monitor the same interfaces. Both are configured to poll every minute.

For the same interface the current and average #s for the interface in question are close but not the same but the max numbers are very different.

MRTG 5 Daily Graph (5 Minute Average)

Graph indicates bits / sec over time (24 hour day - military time)

Maximal In 32.672 M (32.67%) Maximal Out 98.683 M ( 98.68%)
Average In 5.349 M ( 5.35%) Average Out 94.490 M (94.49%)
Current In 6.371 N ( 6.37%) Current Out 94.224 M (94.22 %)


NETMRG Daily

Graph indicates bits / sec over time (24 hour day - military time)

Inbound Current 7.83 M Average 6.11 M Maximum 36.53 M
Outbound Current 66.29 M Average 60.22 M Maximum 79.94 M

During the period that theses values were recorded/reported a backup job was launched that crossed the interface in question. The job lasted several hours and consisted of two separate/concurrent 5 MegaByte per second streams.

Obviously the MRTG out is the NETMRG in. That said there is a big difference between 98.683 M & 79.94 M etc.

MRTG runs ever 60 seconds (the time stamps on the output confirms this is working as expected. As previously stated the following is set for NetMRG

* * * * * /usr/local/bin/netmrg_cron.sh. Checking out the log files in /usr/local/var/log/netmrg/ also shows that NETMRG is polling every 60 seconds.

Any ideas on why the two return such different values when monitioring the same interface over the same time period?

balleman

11-01-2005 19:10:29

The short answer I don't know. NetMRG itself does not do any processing to the numbers returning from the SNMP GETs (other than determining if they are valid numbers, etc). Any problems with the stats on the graphs are a product of RRDTOOL, which should be the same, since you are using RRDTOOL with your MRTG install as well. Maybe your switch hardware reports inconsistent values? Sounds doubtful. You can run the gatherer in verbose mode, and do the math on the counter values that it is reporting, to check that NetMRG/RRDTOOL are reporting correctly based on what they are receiving from the switch. I'm not sure what to tell you, beyond that. Sorry (.

silfreed

11-01-2005 19:43:17

Have you modified the netmrg.xml file's interval value to be '60' [seconds]?
This affects the way the .rrd files are created, and how the averages and maximums will be stored and calculated. If it's still set at 300 (the default), you'll have to delete and recreate the RRDs (or manually tune them yourself; we might be able to help you with that if you're interested).

-Doug

hosierd

12-01-2005 10:17:57

I've confirmed that the polling interval value in the netmrg.xml file is (and was) set to 60. I made that change before ever monitoring anything with NetMRG (thanks to a helpful post in the forums).