Interface_traffic probe not reporting the correct interface utilisation

Products

• DX Unified Infrastructure Management (Nimsoft / UIM)

Issue/Introduction

We are monitoring quite a few network devices from the interface_traffic probe. We have it set to alarm when the interface utilisation breaches 75%. 

The problem we have is that the probe isn't reporting the correct utilization. The %utilization metric in the USM shows around 6-10% utilisation when it's actually closer to 30-50% as seen in interface_traffic probe 5.44

So it's not generating utilization alarms. If I deactivate and reactive the probe it will generate utilization alarms correctly and show the correct qos for maybe 5 mins then it goes back to lower values

When I watch the interface traffic monitor in the probe is showing the correct stats, utilization and traffic rates. 

How do I find out why the probe isn't collecting the correct qos and generating alarms? 

This behavior is seen after upgrade of interface_traffic probe from 5.44 to 5.45

Environment

interface_traffic probe 5.45

Resolution

For every sample value, below calculation is used in interface_traffic probe 5.45: 

a.Data in Values 

octIn = ( Current Value of inOctets OID - Last value of inOctets OID)/tdiff 

 

b.Data in % 

pctOctIn = (octIn*100) / ifSpeed OID Value 

Same thing applies for pctOctOut, just change the OutOctets OID in place of inOctets OID

 

Now these oids are used for 32bit counters and for high speed 64bit counters the oids are : 

• OIDifHCInOctets ".1.3.6.1.2.1.31.1.1.1.6.ifIndex " 

• OIDifHCOutOctets ".1.3.6.1.2.1.31.1.1.1.10.ifIndex " 

 

Now when the probe calculates the delta for these oids and if it comes out to be negative (that is when current value is less than previous value) then in that case the compute delta uses 32bit counter oids : 

• OIDifInOctets ".1.3.6.1.2.1.2.2.1.10.ifIndex " 

• OIDifOutOctets ".1.3.6.1.2.1.2.2.1.16.ifIndex " 

 

The interface_traffic probe 5.44 was not calculating the delta properly in case of negative values. 

This was corrected in interface_traffic probe 5.45.

In customer scenario when interval is set to 5 min and the delta comes negative then the value reported is lower however , in case this is set it to short intervals when there is not much change in delta and value is not negative the probe reports it differently. 

 

 

Additional Information

Interface_traffic  - This probe is no longer supported as of October 1, 2017. This probe is replaced by the snmpcollector probe.

https://techdocs.broadcom.com/content/broadcom/techdocs/us/en/ca-enterprise-software/it-operations-management/ca-unified-infrastructure-management-probes/GA/alphabetical-probe-articles/interface-traffic-interface-traffic-monitoring-no-longer-supported.html

Snmpcollector documentation:
https://techdocs.broadcom.com/content/broadcom/techdocs/us/en/ca-enterprise-software/it-operations-management/ca-unified-infrastructure-management-probes/GA/alphabetical-probe-articles/snmpcollector-snmp-data-monitoring.html