Very strange spikes

[Ehud]

In many of my graph I have a starnge spikes , in one moment my graph jumping to 100M in&out and it's unpssible to have it.
Someone know these strang reason ??


Ehud

[gandalf]

We need more info to help on this:
- SNMP Version configured for this device
- do you use 32bit or 64 bit counters
- what Maximum Values are configured in the related Data Template?
- please do a rrdtool info <rrdfile> for the rrd in question (get this from the Data Source related to the Graph) and post the first 30 lines
- perhaps a screenshot of that graph would help

Reinhard

[Ehud]

NET-SNMP 5.X
rrd tool 1.X
I am using 32 bit counter
snmp version 1
I am using fedora core 4 cacti 0.8g
Thank's ALOT !!, Ehud

This is the Graph source :
/usr/bin/rrdtool graph - \
--imgformat=PNG \
--start=-86400 \
--end=-300 \
--title="wan out " \
--rigid \
--base=1000 \
--height=120 \
--width=500 \
--alt-autoscale-max \
--lower-limit=0 \
--vertical-label="bits per second" \
DEF:a="/var/www/html/cacti/rra/wanout1_traffic_in_213.rrd":traffic_in:AVERAGE \
DEF:b="/var/www/html/cacti/rra/wanout1_traffic_in_213.rrd":traffic_out:AVERAGE \
CDEF:cdefa=a,8,* \
CDEF:cdeff=b,8,* \
AREA:cdefa#00CF00:"Inbound" \
GPRINT:cdefa:LAST:" Current\:%8.2lf%s" \
GPRINT:cdefa:AVERAGE:"Average\:%8.2lf%s" \
GPRINT:cdefa:MAX:"Maximum\:%8.2lf%s" \
COMMENT:"Total In: 352.12 GB\n" \
LINE1:cdeff#002A97:"Outbound" \
GPRINT:cdeff:LAST:"Current\:%8.2lf%s" \
GPRINT:cdeff:AVERAGE:"Average\:%8.2lf%s" \
GPRINT:cdeff:MAX:"Maximum\:%8.2lf%s" \
COMMENT:"Total Out: 425.24 GB"

[gandalf]

I steill need the infos from
- what Maximum Values are configured in the related Data Template?
- please do a rrdtool info <rrdfile> for the rrd in question (get this from the Data Source related to the Graph) and post the first 30 lines
Reinhard

[Ehud]

filename = "wanout1_traffic_in_213.rrd"
rrd_version = "0001"
step = 300
last_update = 1141039322
ds[traffic_out].type = "COUNTER"
ds[traffic_out].minimal_heartbeat = 600
ds[traffic_out].min = 0.0000000000e+00
ds[traffic_out].max = 1.0000000000e+08
ds[traffic_out].last_ds = "3929640284"
ds[traffic_out].value = 6.9762997097e+08
ds[traffic_out].unknown_sec = 0
ds[traffic_in].type = "COUNTER"
ds[traffic_in].minimal_heartbeat = 600
ds[traffic_in].min = 0.0000000000e+00
ds[traffic_in].max = 1.0000000000e+08
ds[traffic_in].last_ds = "101407148"
ds[traffic_in].value = 5.4533533119e+08
ds[traffic_in].unknown_sec = 0
rra[0].cf = "AVERAGE"
rra[0].rows = 600
rra[0].pdp_per_row = 1
rra[0].xff = 5.0000000000e-01
rra[0].cdp_prep[0].value = NaN
rra[0].cdp_prep[0].unknown_datapoints = 0
rra[0].cdp_prep[1].value = NaN
rra[0].cdp_prep[1].unknown_datapoints = 0
rra[1].cf = "AVERAGE"
rra[1].rows = 700
rra[1].pdp_per_row = 6
rra[1].xff = 5.0000000000e-01
rra[1].cdp_prep[0].value = 2.4545683474e+07
rra[1].cdp_prep[0].unknown_datapoints = 0
rra[1].cdp_prep[1].value = 1.9099870838e+07
rra[1].cdp_prep[1].unknown_datapoints = 0
rra[2].cf = "AVERAGE"
rra[2].rows = 775
rra[2].pdp_per_row = 24
rra[2].xff = 5.0000000000e-01
rra[2].cdp_prep[0].value = 1.2383675114e+08
rra[2].cdp_prep[0].unknown_datapoints = 0
rra[2].cdp_prep[1].value = 9.8332476147e+07
rra[2].cdp_prep[1].unknown_datapoints = 0
rra[3].cf = "AVERAGE"
rra[3].rows = 797
rra[3].pdp_per_row = 288
rra[3].xff = 5.0000000000e-01
rra[3].cdp_prep[0].value = 6.4811781849e+08
rra[3].cdp_prep[0].unknown_datapoints = 0
rra[3].cdp_prep[1].value = 5.4011340443e+08
rra[3].cdp_prep[1].unknown_datapoints = 0
rra[4].cf = "MAX"
rra[4].rows = 600
rra[4].pdp_per_row = 1
rra[4].xff = 5.0000000000e-01
rra[4].cdp_prep[0].value = NaN
rra[4].cdp_prep[0].unknown_datapoints = 0
rra[4].cdp_prep[1].value = NaN
rra[4].cdp_prep[1].unknown_datapoints = 0
rra[5].cf = "MAX"
rra[5].rows = 700
rra[5].pdp_per_row = 6
rra[5].xff = 5.0000000000e-01
rra[5].cdp_prep[0].value = 6.3171099382e+06
rra[5].cdp_prep[0].unknown_datapoints = 0
rra[5].cdp_prep[1].value = 4.8908660252e+06
rra[5].cdp_prep[1].unknown_datapoints = 0
rra[6].cf = "MAX"
rra[6].rows = 775
rra[6].pdp_per_row = 24
rra[6].xff = 5.0000000000e-01
rra[6].cdp_prep[0].value = 1.9585122745e+07
rra[6].cdp_prep[0].unknown_datapoints = 0
rra[6].cdp_prep[1].value = 1.7688019015e+07
rra[6].cdp_prep[1].unknown_datapoints = 0
rra[7].cf = "MAX"
rra[7].rows = 797
rra[7].pdp_per_row = 288
rra[7].xff = 5.0000000000e-01
rra[7].cdp_prep[0].value = 1.9585122745e+07
rra[7].cdp_prep[0].unknown_datapoints = 0
rra[7].cdp_prep[1].value = 1.8317912456e+07
rra[7].cdp_prep[1].unknown_datapoints = 0

[gandalf]

Ok, the max values seem to be good (although too high by a factor of 8, but this is "normal" for cacti). As the input/ouput is nearly constant, counter wraps (that should be handled correctly by rrdtool) should not happen. An assumption: is it possible, that cacti could not get the snmp data for some single run on that target? So next time, it will report double the amount of traffic. Is it possible for you to check that?
Reinhard

[Ehud]

The problem is that the I have the pickes in many graphs even in a graph of 2M I have pickes of 150M (in and out) and it's look like the snmp working fine.
The picks are for one single moment and it's really destroying the graph, I checked it with sniffer that showed me normal resault without the strange spikes.

Ehud.

[TheWitness]

Ehud,

If you are using Cactid, then the problem is that you are using a version prior to 0.8.6g. But, instead of using 0.8.6g, please use the beta that I have published here:

http://bugs.cacti.net/view.php?id=706

You will also have to utilize the "remove spikes" perl script to clean up the graphs. It's not rocket science, but it will take you a bit to figure it out. Make a backup first.

TheWitness

[Ehud]

No I am not using cactid

[TheWitness]

What is your re-index method for this host set to?