I monitoring the Bandwith on Switch-Ports with the functions of th Probe Thread. But after a time, I think thats when the SNMP counter is full and goes to 0, there are spikes to minus. Have anybody here an idea.
Your tool doesn’t handle counter rollovers correctly. Interfaces keep 32bit (sometimes 64bit) counters of bytes transferred. SNMP at time A queries and gets 100 bytes as a result. It queries again at time B one second later and gets 200 bytes. Now it knows that the bandwidth utilization was (200 - 100) bytes / 1 second = 100bps. Since the counters can’t increase indefinitely, at some point the 32bit or 64bit counter will overflow back to 0. Some tools don’t account for this and don’t generate the detail right, and produce negative values. Read at time A is 200 bytes, read at time B is 10 bytes one second later, so it reports (10 - 200) bytes / 1 second = -190bps. That’s a flaw in the tool, and not on the router.
I use The Dude and want to make graphs from the GB (fiber) ports of HP Procurve and 3 com Switches like this from The Probe Thread, Lebowski have there an example
rate(((oid(“inoctets”)+oid(“outoctets”))*8),30)
the positiv output is good I have compared this with Solarwinds NetFlowAnalyzer, but after a while there are these negativ spikes.
Excuse my bad english, I m a german admin.
If I monitor rx and tx separately the graphs are allright as snmp oid or as function its the same, no negative
Do I add rx and tx (oid inoctets + oid outoctets) in a function then after a while the negative spikes appear
I have tested different intervals and snmp settings etc its allways the same, also i have tested on a single core processor machine, the same behavior
Hallo fewi
does this mean the dude does#nt handle counter rollovers correctly ?