We are monitoring quite a few network devices from the interface_traffic probe. We have it set to alarm when the interface utilisation breaches 75%.
The problem we have is that the probe isn't reporting the correct utilization. The %utilization metric in the USM shows around 6-10% utilisation when it's actually closer to 30-50% as seen in interface_traffic probe 5.44
So it's not generating utilization alarms. If I deactivate and reactive the probe it will generate utilization alarms correctly and show the correct qos for maybe 5 mins then it goes back to lower values
When I watch the interface traffic monitor in the probe is showing the correct stats, utilization and traffic rates.
How do I find out why the probe isn't collecting the correct qos and generating alarms?
This behavior is seen after upgrade of interface_traffic probe from 5.44 to 5.45
For every sample value, below calculation is used in interface_traffic probe 5.45:
a.Data in Values
octIn = ( Current Value of inOctets OID - Last value of inOctets OID)/tdiff
b.Data in %
pctOctIn = (octIn*100) / ifSpeed OID Value
Same thing applies for pctOctOut, just change the OutOctets OID in place of inOctets OID
Now these oids are used for 32bit counters and for high speed 64bit counters the oids are :
• OIDifHCInOctets ".220.127.116.11.18.104.22.168.1.1.6.ifIndex "
• OIDifHCOutOctets ".22.214.171.124.126.96.36.199.1.1.10.ifIndex "
Now when the probe calculates the delta for these oids and if it comes out to be negative (that is when current value is less than previous value) then in that case the compute delta uses 32bit counter oids :
• OIDifInOctets ".188.8.131.52.184.108.40.206.1.10.ifIndex "
• OIDifOutOctets ".220.127.116.11.18.104.22.168.1.16.ifIndex "
The interface_traffic probe 5.44 was not calculating the delta properly in case of negative values.
This was corrected in interface_traffic probe 5.45.
In customer scenario when interval is set to 5 min and the delta comes negative then the value reported is lower however , in case this is set it to short intervals when there is not much change in delta and value is not negative the probe reports it differently.