Xymon Mailing List Archive search

Weird value in devmon graph

3 messages in this thread

list Olivier Audry · Mon, 9 May 2011 12:02:10 +0200 (CEST) ·
hello

during two days this week end we got very huge value in all my devmon graph. See the attachement. Since this morning no more issue.

any idee ? Perhaps we can add a max value at the rrd creation ?

oau
Attachments (1)
list Olivier Audry · Mon, 9 May 2011 14:31:37 +0200 (CEST) ·
many thx I will do this 
oau

----- Mail original -----
quoted from Olivier Audry
De: "W.J.M. Nelis" <user-6956df205d63@xymon.invalid>
À: "Olivier AUDRY" <user-0dc286edb094@xymon.invalid>
Envoyé: Lundi 9 Mai 2011 13:52:50
Objet: Re: [Xymon] Weird value in devmon graph

Hello,
during two days this week end we got very huge value in all my devmon graph. See the attachement. Since this morning no more issue.

any idee ? Perhaps we can add a max value at the rrd creation ?
  
We see similar graphs from a few devices which at random times reset all their SNMP counters. If the throughput is measured using a 32-bit counter, and if you are using type COUNTER in the RRD, a reset of a counter is interpreted as a counter-wrap. With an polling frequency of once per 120 seconds, you will see peaks of up to 290 [Mb/s].  This explains that there might be peaks, it does not explain that the peak-values are effectivly the same in the instances shown.

If a reset of the SNMP counters turns out to be the cause, you could solve it (A) by using 64-bit counters or (B) by using type DERIVE in RRD combined with a lower limit of zero. The limit will "annihilate" any negative derivates.

Kind regards,
  Wim Nelis.


*******************************************************************************************************
The NLR disclaimer (http://www.nlr.nl/emaildisclaimer) is valid for NLR e-mail messages.
*******************************************************************************************************
list Phil Crooker · Tue, 10 May 2011 09:45:43 +1000 ·
Are you sure this isn't genuine network traffic? Do you have a smart
switch where you can double check this is really happening? 

Or are you asking for the ability to truncate the comparatively high
readings? I'd think you'd want to know such high traffic periods are
happening?

On 5/9/2011 at 7:32 PM, in message
<user-cb99319c1f70@xymon.invalid>, Olivier
AUDRY
quoted from Olivier Audry
<user-0dc286edb094@xymon.invalid> wrote:
hello

during two days this week end we got very huge value in all my devmon
graph. 
See the attachement. Since this morning no more issue.

any idee ? Perhaps we can add a max value at the rrd creation ?

oau