Counter wrapping at 2,147,483,648

[lancelovette]

I have an SNMP counter that wraps at 2,147,483,648 which is the max for a signed integer. I set the min to 0 and max to 2,147,483,648. When I use a DERIVE counter, a gap appears in the graph at the point of rollover. If I use a COUNTER counter, a huge spike appears in the graph at the point of rollover. In the past, DERIVE has proven to give me the results I want. But now that I've upgraded to the new Cacti and latest RRDTool, I'm having this issue. Any suggestions?

[bulek]

When a counter wraps on signed integer it goes to negative numbers. This is handled automatically by rrdtools and you should not see any peaks. You can see them however after counter reset (I mean from huge value to 0). This is where maximum value set in DS can help. Your max value is wrong since COUNTER stores a rate (value change/sec) not the counter value. You did not mention what kind of data you're monitoring but you should set maximum value accordingly (like 1250000 for 10Mb Ethernet which is the maximum possible rate in bytes/sec).

- Piotr

[duckhead]

Let me guess, you're using SNMPv1. the COUNTERS in SNMPv1 are a signed 32-bit quantity (actually, so are the GAUGES and everything else...) So, you should expect them to roll at 2^31 -1.

If you want to graph the values correctly, you'll have to use SNMPv2 or above, and use the corresponding 64-bit values.

duckhead

[bulek]

That is not true. Most of people use 32bit counters for traffic monitoring. The counters roll frequently and rrdtools take care of this without any gaps or peaks on the graph (with proper maximum value set). you have to use 64bit counters only if it rolls more frequent than your polling period.

- Piotr

[lancelovette]

The rollover is being done by the software that I'm polling, not by SNMP itself. The software just doesn't count higher than 2,147,483,648. Does RRDTOOL just not deal well with counters that wrap at values less than 2^32?

[bulek]

I checked again and it seems that signed counters rollovers are not handled by rrdtools. Only unsigned 32bit and 64bit counters are handled. This means the only hope for you is maximum value set in data source - this will avoid peaks on the graph. Instead of peak in such case you may see very small gap (the point in time when rate calculation cannot be made because of rollover).

- Piotr