check_iftraffic64.pl inconsistent data

Support forum for Nagios Core, Nagios Plugins, NCPA, NRPE, NSCA, NDOUtils and more. Engage with the community of users including those using the open source solutions.
Locked
bdario58
Posts: 1
Joined: Mon Sep 16, 2019 5:37 am

check_iftraffic64.pl inconsistent data

Post by bdario58 »

hello to all,
my environment:
Nagios Core 4.4.3 on CentOS 7
Pluging check_iftraffic64.pl ver. 77
object to monitor a switch HP5130

when I test the pluging I receive inconsistent data in 64 bit and 32 bit
I.E.
# ./check_iftraffic64.pl -C snmpstring -H 10.10.60.101 -i Ten-GigabitEthernet1/0/49 -d 4
DEBUG ENABLED at level: 4
INTERFACE DESCR: Ten-GigabitEthernet1/0/49
BYTE COUNTER max_value: 1.84467440737096e+19
[...]
RESULTS:
Operational Status: 1
Interface Speed (64bit): 1000 Mbits
Interface Speed (32bit): 1000000000 bits
In Bytes (64bit): 79593553925206 <----- why this difference compared to the 32 bits value?
In Bytes (32bit): 3514963030 <----------- why this difference compared to the 64 bits value?
Out Bytes (64bit): 4060085470804 <---- why this difference compared to the 32 bits value?
Out Bytes (32bit): 1341376084 <-------- why this difference compared to the 64 bits value?
[...]
Can someone teach me how to fix this issue?
Best regards
Dario
scottwilkerson
DevOps Engineer
Posts: 19396
Joined: Tue Nov 15, 2011 3:11 pm
Location: Nagios Enterprises
Contact:

Re: check_iftraffic64.pl inconsistent data

Post by scottwilkerson »

Monitoring of network devices is often done using SNMP. SNMP has 32-bit and 64-bit counters.

The maximum value that can be held in a 32-bit counter is 4,294,967,295. As that is a byte count, that represents 34,359,738,368 bits or 34,359.74 megabits. Divide that by 300 (seconds in 5 minutes) and you get 114.5. Therefore if the average bandwidth is above 114.5Mbit/s for 5 minutes, you will overflow a 32-bit counter. When the counter overflows it wraps back through zero.

Wrapping a counter once is fine. We have to expect that a counter will wrap eventually, and as counters never decrease, if a new value is smaller than the previous one then we know it has wrapped and can still work out what the rate should be.

The problem comes when the counter wraps more than once. There is no way to tell how many times it has wrapped so the monitoring system will have to assume the answer is once. Once traffic reaches ~229Mbit/s the counters will be wrapping at least twice in 5 minutes and the statistics become meaningless.
https://strugglers.net/~andy/blog/2017/ ... t-counter/
Former Nagios employee
Creator:
ahumandesign.com
enneagrams.com
Locked