Huge peaks in traffic graphs

[vladc]

Hello everybody,

I'm getting high peaks in traffic graphs on some Cisco routers. I've checked to see if that was the result of an interface reset but I didn't find anything wrong on the router.
So I've checked the rrd.log file and I saw something like:

07/07/2004 5:49 PM - CMD: /opt/rrdtool-1.0.42/bin/rrdtool update /opt/cacti-0.8.2a//rra/rbaca1_traffic_in_1456.rrd --template traffi
c_out:traffic_in N:855987334:288555398
07/07/2004 5:54 PM - CMD: /opt/rrdtool-1.0.42/bin/rrdtool update /opt/cacti-0.8.2a//rra/rbaca1_traffic_in_1456.rrd --template traffi
c_out:traffic_in N:855987666:288564526
07/07/2004 5:59 PM - CMD: /opt/rrdtool-1.0.42/bin/rrdtool update /opt/cacti-0.8.2a//rra/rbaca1_traffic_in_1456.rrd --template traffi
c_in:traffic_out N:288549570:855988374
07/07/2004 6:05 PM - CMD: /opt/rrdtool-1.0.42/bin/rrdtool update /opt/cacti-0.8.2a//rra/rbaca1_traffic_in_1456.rrd --template traffi
c_in:traffic_out N:288560190:855988706
07/07/2004 6:09 PM - CMD: /opt/rrdtool-1.0.42/bin/rrdtool update /opt/cacti-0.8.2a//rra/rbaca1_traffic_in_1456.rrd --template traffi
c_in:traffic_out N:288569594:855988830
07/07/2004 6:14 PM - CMD: /opt/rrdtool-1.0.42/bin/rrdtool update /opt/cacti-0.8.2a//rra/rbaca1_traffic_in_1456.rrd --template traffi
c_in:traffic_out N:288578618:855988954
07/07/2004 6:19 PM - CMD: /opt/rrdtool-1.0.42/bin/rrdtool update /opt/cacti-0.8.2a//rra/rbaca1_traffic_in_1456.rrd --template traffi
c_in:traffic_out N:288588978:855988954
07/07/2004 6:24 PM - CMD: /opt/rrdtool-1.0.42/bin/rrdtool update /opt/cacti-0.8.2a//rra/rbaca1_traffic_in_1456.rrd --template traffi
c_in:traffic_out N:288598590:855989136
07/07/2004 6:28 PM - CMD: /opt/rrdtool-1.0.42/bin/rrdtool update /opt/cacti-0.8.2a//rra/rbaca1_traffic_in_1456.rrd --template traffi
c_in:traffic_out N:288607010:855989136
07/07/2004 6:34 PM - CMD: /opt/rrdtool-1.0.42/bin/rrdtool update /opt/cacti-0.8.2a//rra/rbaca1_traffic_in_1456.rrd --template traffi
c_in:traffic_out N:288616690:855989298
07/07/2004 6:39 PM - CMD: /opt/rrdtool-1.0.42/bin/rrdtool update /opt/cacti-0.8.2a//rra/rbaca1_traffic_in_1456.rrd --template traffi
c_in:traffic_out N:288626722:855989506
07/07/2004 6:44 PM - CMD: /opt/rrdtool-1.0.42/bin/rrdtool update /opt/cacti-0.8.2a//rra/rbaca1_traffic_in_1456.rrd --template traffi
c_in:traffic_out N:288636426:855990788
07/07/2004 6:48 PM - CMD: /opt/rrdtool-1.0.42/bin/rrdtool update /opt/cacti-0.8.2a//rra/rbaca1_traffic_in_1456.rrd --template traffi
c_in:traffic_out N:288646106:855990788


Something happened at 5:59 PM and I can't understand why. Before that, the data collection was based on the traffic_out:traffic_in template and after that (without any modifications in the data source settings, graph settings etc)
the template became traffic_in:traffic_out. Does anyone know what is going on? I'm using cacti-0.8.2a.

Thank you,
vlad

[grog]

update your cacti, that version is ancient..

use killspike2 to remove the out-of-range values from your existing data. if you set reasonable limits on your data sources, this wont happen...

THiS iS CoVeReD iN THe FaQ

[Guest]

Thank you for your reply. I know it's an "ancient" version of Cacti and maybe it's time to make an upgrade. In my case, the problem was not generated by a reset on the traffic counters. The peak was the result of the reversed order for traffic_in:traffic_out counters.

At 5:54 PM, traffic_out=855987666 and traffic_in=288564526 and the template was traffic_out:traffic_in.
At 5:59 PM the template became traffic_in:traffic_out N:288549570:855988374 (reversed order) and I think rrd was updated with the reversed values ( old traffic_in was 855987666 and the new one 288549570 etc).