[solved] Cisco Catalyst 6500/7600 VLAN Problem

[circulum]

Hi there,

i have a problem with monitoring the traffic of a VLAN on a Cisco Catalyst 6500/7600.
Cacti gatheres data, but the information makes no sense.
There should be traffic above 500 KBits/s, but the graph only shows 600 Bit/s.

I also tried the templates here from the forum for the CatOS and the Catalyst 6500 with the same result.

Has anyone an idea?

Greetings Christian

[Howie]

SVI (vlan interface) traffic counters don't show much traffic because it only counts traffic that hits the CPU, not traffic that is hardware-switched (i.e. most traffic on 6500/7600).

There isn't a fix as far as I know - it's just the way the ASICs work. The same issue affects netflow on those platforms, too.

That said, I can't find a reference to this right now, so maybe someone else can confirm.

[BSOD2600]

Wrong forum, moving.

[Frizz]

Hi there,

i have a problem with monitoring the traffic of a VLAN on a Cisco Catalyst 6500/7600.
Cacti gatheres data, but the information makes no sense.
There should be traffic above 500 KBits/s, but the graph only shows 600 Bit/s.

I also tried the templates here from the forum for the CatOS and the Catalyst 6500 with the same result.

Has anyone an idea?

Greetings Christian

Christian, It's absolute correct what Howie mentioned.
On 65xx with MSFC cards the byte_in and _out counter is only the traffic that passes the first time through the supervisor engine. If the destination port is determined only the counter of the physical interface is relevant.
You must collect only the physical interfaces, of course not seperated in VLAN's. When we started with Cacti we also monitored several 1000 VLANS, but nobody had any purpose of them and we deleted them all.

And I did NOT agree to BSOD2600 . This is the forum for these questions, because they are very typical and advisable for all Cacti user, because at the first step you include every interface you see in the interface list.
Best regards
Frizz

[circulum]

Thanks for posting

[giggudy]

SVI (vlan interface) traffic counters don't show much traffic because it only counts traffic that hits the CPU, not traffic that is hardware-switched (i.e. most traffic on 6500/7600).

There isn't a fix as far as I know - it's just the way the ASICs work. The same issue affects netflow on those platforms, too.

That said, I can't find a reference to this right now, so maybe someone else can confirm.

This is partially right.

If the VLAN has an SVI (routed interface) it will graph the traffic minus the Ethernet headers, which depending on the size of your packets can be a little or a lot of traffic. An FTP site might have a < 1% discrepancy (typically large packets), whereas a VoIP provider may have > 10% discrepancy (typically small packets).

If you just have a VLAN without an SVI, you won't graph anything of consequence.

[igrey]

I have more interesting
Cacti won't graph more then 8Gbit/s on SVI.
But rrdtool info traffic_in_59.rrd show:

Code: Select all

rra[6].cf = "MAX"
rra[6].rows = 775
rra[6].cur_row = 435
rra[6].pdp_per_row = 24
rra[6].xff = 5.0000000000e-01
rra[6].cdp_prep[0].value = 8.9368306088e+08
rra[6].cdp_prep[0].unknown_datapoints = 0
rra[6].cdp_prep[1].value = 9.8504397424e+08
rra[6].cdp_prep[1].unknown_datapoints = 3
rra[7].cf = "MAX"
rra[7].rows = 797
rra[7].cur_row = 513
rra[7].pdp_per_row = 288
rra[7].xff = 5.0000000000e-01
rra[7].cdp_prep[0].value = 8.9368306088e+08
rra[7].cdp_prep[0].unknown_datapoints = 0
rra[7].cdp_prep[1].value = 9.9777012098e+08
rra[7].cdp_prep[1].unknown_datapoints = 4

7606/SUP720-3BXL

[BSOD2600]

1) rrdtool graph command + picture
2) using snmpv2 and 64bit graph templates?
3) rrdtool info <filename> to check if the DS MAX is too small.

[igrey]

1) rrdtool graph command + picture

Code: Select all

RRDTool Command:
/opt/rrdtool-1.4.4/bin/rrdtool graph - \
--imgformat=PNG \
--start=-86400 \
--end=-300 \
--title='ACCESS' \
--rigid \
--base=1000 \
--height=120 \
--width=600 \
--alt-autoscale-max \
--lower-limit=0 \
--vertical-label='bits per second' \
--slope-mode \
--font TITLE:8: \
--font AXIS:7: \
--font LEGEND:8: \
--font UNIT:8: \
DEF:a="/usr/local/share/cacti/rra/traffic_in_59.rrd":traffic_in:AVERAGE \
DEF:b="/usr/local/share/cacti/rra/traffic_in_59.rrd":traffic_out:AVERAGE \
CDEF:cdefa=a,8,* \
CDEF:cdefe=b,8,* \
LINE1:cdefa#00CF00FF:"Inbound"  \
GPRINT:cdefa:LAST:" Current\:%8.2lf %s"  \
GPRINT:cdefa:AVERAGE:"Average\:%8.2lf %s"  \
GPRINT:cdefa:MAX:"Maximum\:%8.2lf %s\n"  \
LINE1:cdefe#002A97FF:"Outbound"  \
GPRINT:cdefe:LAST:"Current\:%8.2lf %s"  \
GPRINT:cdefe:AVERAGE:"Average\:%8.2lf %s"  \
GPRINT:cdefe:MAX:"Maximum\:%8.2lf %s\n" 
RRDTool Says:
OK

2) using snmpv2 and 64bit graph templates?

Both - yes.

3) rrdtool info <filename> to check if the DS MAX is too small.

Code: Select all

rrdtool info traffic_in_59.rrd 
filename = "traffic_in_59.rrd"
rrd_version = "0003"
step = 300
last_update = 1284065701
header_size = 2764
ds[traffic_in].index = 0
ds[traffic_in].type = "COUNTER"
ds[traffic_in].minimal_heartbeat = 600
ds[traffic_in].min = 0.0000000000e+00
ds[traffic_in].max = 1.0000000000e+09
ds[traffic_in].last_ds = "402905928935730"
ds[traffic_in].value = 6.3446900365e+08
ds[traffic_in].unknown_sec = 0
ds[traffic_out].index = 1
ds[traffic_out].type = "COUNTER"
ds[traffic_out].minimal_heartbeat = 600
ds[traffic_out].min = 0.0000000000e+00
ds[traffic_out].max = 1.0000000000e+09
ds[traffic_out].last_ds = "454698010532716"
ds[traffic_out].value = 6.3471904741e+08
ds[traffic_out].unknown_sec = 0

Or I need to show full output?

[TheWitness]

Check the max value in the RRDFile.

TheWitness

[igrey]

Check the max value in the RRDFile.

TheWitness

Thanks a lot for comment.

I know about rrd_maximum.

In Data_Querie set:
rrd_maximum 100000000000.

Btw, on physical interface I saw 8.84G graph.

[BSOD2600]

The problem:

Code: Select all

ds[traffic_in].max = 1.0000000000e+09
ds[traffic_in].last_ds = "402905928935730" 

402905928935730 = 4.029 x 10^14.

As I suspected, the MAX DS is too small.

[igrey]

The problem:

Code: Select all

ds[traffic_in].max = 1.0000000000e+09
ds[traffic_in].last_ds = "402905928935730" 

402905928935730 = 4.029 x 10^14.

As I suspected, the MAX DS is too small.

Ok, understood.
Could you please, what I need to do for increase MAX DS?

[BSOD2600]

Use the rrdtool tune command. More details in the rrdtool man pages.

[igrey]

Use the rrdtool tune command. More details in the rrdtool man pages.

Thanks a lot, everything work just great.