Spike in interface statistics

[agm]

Hey Guys

I've got a weird problem, where my ethernet interfaces all seem to spike at about 100Mbit at around the same time every night. This isn't legitimate traffic I believe it's being caused by my hosting providers systems. So all the servers are hosted in a cloud except a a couple of branch office routers etc which report correct statistics.

As you can see from the attachments it really upsets my graphing, is there a way to somehow filter out this random spike?


Thank you.

Andrew.

5 Min spike

spike_5min.png (21.33 KiB) Viewed 861 times

30 Min spike

spike_30min.png (21.68 KiB) Viewed 861 times

[gandalf]

These usually are counter wraps. You may suppress them by using a reasonable data source item MAXimum value. Existing rrd files will have to be tweaked using rrdtool tune
R.

[agm]

These usually are counter wraps. You may suppress them by using a reasonable data source item MAXimum value. Existing rrd files will have to be tweaked using rrdtool tune
R.

Thank you for your reply Gandalf.

I've done some research to understand what counter wraps are and I believe it may be an issue because the interfaces are all 10Gbit. So I've configured a 64bit counter on the interface to see if that makes a difference. I've also noticed that the 10Gbit interface is only being queried as 4Gbit, which is strange but not an issue as I won't be pushing > 4Gbit through the link.

[gandalf]

Be aware, that 64bit COUNTERs require al least SNMP V2c
R.

[agm]

I'm assuming the attached screenshot is all that needs to be configured to ensure version snmp 2c is being used?

I got the same spikes using brand new graphs and the 64bit counters, so I'm wondering if there is something else I'm doing wrong. You mentioned adjusting the maxium value in the graph, should I manually set that to 10Gbit?

*edit* see attached data source screenshot. I've manually set the interface speed to 10Gbit and I've done a poller cache rebuild for it (I think I did the rebuild correctly) I'll have to wait until later tonight to see if it has resolved the problem.

I ran the following command it worked without problem, so I'm assuming that version 2c is working correctly on the host.

Code: Select all

# snmpget -v 2c -c public server1 system.sysUp
Time.0
DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (120824739) 13 days, 23:37:27.3
9

snmp_config

snmp_version.png (12.42 KiB) Viewed 834 times

data_source_ifspeed

data_source_ifspeed.png (29.5 KiB) Viewed 830 times

[gandalf]

looks good. But as you changed MAX setting in data template, please make sure that the rrd file uses this value. This will happen in case the rrd file was created AFTER that very change. If not, please use "rrdtool tune" to apply that change to this rrd file
R

[agm]

Hrmm well I'm still getting the same issue... I deleted those graphs and created brand new ones using 64bit counters and before the RRD was created I manually set the max interface speed to 10000000000...

I'm at a loss as to what I can do to resolve the spikes...

still spiking

spike_5min1.png (21.41 KiB) Viewed 821 times