strange dip in in/out bits for router interfaces

[lilnick]

I noticed this morning that there was a HUGE spike on all of my traffic graphs for some 15 routers. The spike occurred at the exact same time and appeared to be the same amount - approximately 113Mb/s. This is far beyond what any of these interfaces are capable of - they are all T1 interfaces.

Looking through the cacti logs I see a common issue across all the devices at the same time. I have a 5 minute cron setup and the following are the in/out bits I get surrounding the spike (for one example):

10:45 traffic_in:traffic_out N:1048317276:4175611712
10:48 traffic_in:traffic_out N:971795743:3964611893
10:50 traffic_in:traffic_out N:1053348718:4184917139

That small dip seems to be pretty clearly the reason for the spike, but I have no idea why this would have happened. Why would cmd.php even have run at this time with a 5 minute cron? Why would the values returned have been lower than the previous query?

If anyone can give me some ideas about where to go with this that would be great. I don't have any idea where to start looking for reasons.

I'm running cacti 0.8.4 - the devices being queried are Cisco & netopia routers.

Thanks in advance.
Aaron

[bulek]

The only thing that comes into my mind is some older cmd.php process that hanged for longer period of time and then it returned "old" data to rrd files. Since cacti does not support timestamps when updating rrd files the "old" data were not dropped.

The other thing is you should have configured proper "maximum value" in DS settings - that would avoid spikes in most of cases.

- Piotr

[lilnick]

The only problem with setting the maximum value is that I'm using polling hosts and templates - thus the same DS template is used for interfaces of varying speeds, making it difficult (impossible?) to set a limit in the template.

Thanks for the info though

-Aaron

[bulek]

Well... you can always modify your template and allow for Maximum Value modification in created datasources. This of course causes a bit more of maintenance work... depends how much do you want to have nice graphs .

- Piotr

[lilnick]

You're right - had not thought of that. I'll give that a shot and see how it works out. I'm not too concerned w/ maintenance - the template approach has already dramatically reduced the maintenance required.

Thanks again,
Aaron