Apparently Incorrect / Sporadic Traffic

[superdave913]

I am currently graphing the network interface of one of my web servers. The graphs seem to be showing incorrect statistics. (Attached is a sample) It appears as if the network gets maxed sporadically. It seems to be virtually impossible for this to be accurate. The machine DOES have data mounted via NFS. Is that what's causing this?

Any help is appreciated!
Thanks,
Dave

[gandalf]

This is a known error for using 32 bit counters with snmp v1 for values > 114 Mbits. Use 64 bit counters (select 64 bit counter templates from the interface graph dropdown selection) and snmp V2 instead. There are some postings on this topic in the forum
Reinhard

[superdave913]

I was already using SNMP v2.
I tried the 64bit counters, but then it didn't seem to be able to find any data. It would just show "nan".

What else can I try?

[rony]

That would be the unfortunate side effect of the device not supporting 64-bit counters..

[rony]

Um, what is the device you this graph is generated from?

[superdave913]

[root@seal ~]# uname -a
Linux seal 2.6.9-11.ELsmp #1 SMP Fri May 20 18:25:30 EDT 2005 x86_64 x86_64 x86_64 GNU/Linux

[root@seal ~]# cat /etc/issue
Red Hat Enterprise Linux ES release 4 (Nahant Update 2)


lspci output:
03:01.0 Ethernet controller: Intel Corporation 82546GB Gigabit Ethernet Controller (rev 03)
Subsystem: Inventec Corporation: Unknown device 0015
Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV+ VGASnoop- ParErr+ Stepping- SERR+ FastB2B-
Status: Cap+ 66Mhz+ UDF- FastB2B- ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR-
Latency: 32 (63750ns min), Cache Line Size 10
Interrupt: pin A routed to IRQ 209
Region 0: Memory at fc9c0000 (64-bit, non-prefetchable)
Region 4: I/O ports at c800
Capabilities: [dc] Power Management version 2
Flags: PMEClk- DSI+ D1- D2- AuxCurrent=0mA PME(D0+,D1-,D2-,D3hot+,D3cold+)
Status: D0 PME-Enable- DSel=0 DScale=1 PME-
Capabilities: [e4] PCI-X non-bridge device.
Command: DPERE- ERO+ RBC=0 OST=0
Status: Bus=3 Dev=1 Func=0 64bit+ 133MHz+ SCD- USC-, DC=simple, DMMRBC=2, DMOST=0, DMCRS=1, RSCEM-
Capabilities: [f0] Message Signalled Interrupts: 64bit+ Queue=0/0 Enable-
Address: 0000000000000000 Data: 0000


[root@seal ~]# rpm -qa | grep snmp
net-snmp-libs-5.1.2-11.EL4.6
net-snmp-5.1.2-11.EL4.6
net-snmp-libs-5.1.2-11.EL4.6
[root@seal ~]#

dmesg output:
e1000: eth0: e1000_probe: Intel(R) PRO/1000 Network Connection

Let me know if anyone wants any specific additional info.

[Kinetix]

Let me guess... using net-snmp 5.2.x? I've just setup cacti in the past 24 hours here, and found similar issues coming from my only 64-bit box.

Net-SNMP's errata explains that Counter64's don't work on 64-bit boxes (which has *gotta* make 'ya wonder), at least, that's what I interpret that part of their errata to mean (errata is at http://net-snmp.sourceforge.net/docs/ERRATA.html )

In fact, if you do an snmpwalk multiple times to that system that's giving you odd traffic graphs, I'll bet you're seeing what I was seeing - the In/Out Octet readings for the ethernet interface mirroring the lo numbers...

I've just installed net-snmp 5.3-pre3 on this box, and not only have the Counter64's become available, but all the ethernet in/out octet readings appear to function properly.

(I was also missing host processes information with 5.2.. perhaps just an install problem, not 100% sure, but that's fixed in 5.3-pre3 as well)

[rkramer]

one way around that is to just have your poll interval less then 5 minutes. a 32 bit counter rolls over at 113mb in 5 minutes, so if you went to 1 minute it would be 5X that, so up around 560 mbit. (very few servers will even be able to transport that much, a 66mhz pci bus won't...)

[superdave913]

So am I right in gathering people suggest the latest build of Net-SNMP will fix this?

Dave