check_iftraffic64.pl inconsistent data

This forum is intended for the discussion of Nagios plugin development. Feature requests, patches, bug fixes, and all types of development-related discussions are welcome!

NOTE: The SourceForge.net nagiosplug-devel mailing list has been deprecated in favor of this forum in order to expedite support and provide additional features not available on the old mailing list.

check_iftraffic64.pl inconsistent data

Postby bdario58 » Mon Sep 16, 2019 6:06 am

hello to all,
my environment:
Nagios Core 4.4.3 on CentOS 7
Pluging check_iftraffic64.pl ver. 77
object to monitor a switch HP5130

when I test the pluging I receive inconsistent data in 64 bit and 32 bit
I.E.
# ./check_iftraffic64.pl -C snmpstring -H 10.10.60.101 -i Ten-GigabitEthernet1/0/49 -d 4
DEBUG ENABLED at level: 4
INTERFACE DESCR: Ten-GigabitEthernet1/0/49
BYTE COUNTER max_value: 1.84467440737096e+19
[...]
RESULTS:
Operational Status: 1
Interface Speed (64bit): 1000 Mbits
Interface Speed (32bit): 1000000000 bits
In Bytes (64bit): 79593553925206 <----- why this difference compared to the 32 bits value?
In Bytes (32bit): 3514963030 <----------- why this difference compared to the 64 bits value?
Out Bytes (64bit): 4060085470804 <---- why this difference compared to the 32 bits value?
Out Bytes (32bit): 1341376084 <-------- why this difference compared to the 64 bits value?
[...]
Can someone teach me how to fix this issue?
Best regards
Dario
bdario58
 
Posts: 1
Joined: Mon Sep 16, 2019 5:37 am

Re: check_iftraffic64.pl inconsistent data

Postby scottwilkerson » Mon Sep 16, 2019 11:46 am

Monitoring of network devices is often done using SNMP. SNMP has 32-bit and 64-bit counters.

The maximum value that can be held in a 32-bit counter is 4,294,967,295. As that is a byte count, that represents 34,359,738,368 bits or 34,359.74 megabits. Divide that by 300 (seconds in 5 minutes) and you get 114.5. Therefore if the average bandwidth is above 114.5Mbit/s for 5 minutes, you will overflow a 32-bit counter. When the counter overflows it wraps back through zero.

Wrapping a counter once is fine. We have to expect that a counter will wrap eventually, and as counters never decrease, if a new value is smaller than the previous one then we know it has wrapped and can still work out what the rate should be.

The problem comes when the counter wraps more than once. There is no way to tell how many times it has wrapped so the monitoring system will have to assume the answer is once. Once traffic reaches ~229Mbit/s the counters will be wrapping at least twice in 5 minutes and the statistics become meaningless.

https://strugglers.net/~andy/blog/2017/09/03/when-is-a-64-bit-counter-not-a-64-bit-counter/
As of May 25th, 2018, all communications with Nagios Enterprises and its employees are covered under our new Privacy Policy.
User avatar
scottwilkerson
DevOps Engineer
 
Posts: 17032
Joined: Tue Nov 15, 2011 3:11 pm
Location: Nagios Enterprises


Return to Nagios Plugin Development

Who is online

Users browsing this forum: No registered users and 9 guests