Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

Solarwinds monitoring is utilizing higher network bandwidth than our existing monitoring

Hi,

As mentioned, currently we are implementing the Solarwinds to monitor all our existing servers (300-400) to replace our existing BMC due to the high cost in BMC licensing. Previously, we had a lot of false alarm and after upgrading the APM to the latest version, it solved the false alarm but it utilizes a lot of bandwidth. in 6 hours, it utilizes nearly 300MB of network bandwidth and once, we had turned on nearly 120 servers and the whole network just went down. FYI, we have reduced the monitoring to a very very minimal until further removal will have no reason for us to keep this going on. Eg. Exchange servers monitors 7-8 exchange services and 7 perfmon counters, SNMP is turned on.

Solarwinds support is not helpful at all saying that 'there isnt much that they can do' but utilizing 300MB in 6 hours are not something normal for a single server. We had monitor all the servers on BMC and we turned on more application monitoring than the Solarwinds but we have no issues. Since Solarwinds does not have polling servers, it might be a problem. Anyone having the same problem? Thanks.

FYI,

Component Type	Enabled	Counter	Instance	Category\Net Service
Performance Counter Monitor	Yes	% Processor Time	_Total	Processor
Performance Counter Monitor	Yes	% Free Space	C:	LogicalDisk
Performance Counter Monitor	Yes	Free Megabytes	C:	LogicalDisk
Performance Counter Monitor	Yes	% Committed Bytes In Use		Memory
Windows Service Monitor	Yes			MSExchangeIS
Windows Service Monitor	Yes			MSExchangeMTA
Windows Service Monitor	Yes			RESvc
Windows Service Monitor	Yes			MSExchangeSA
Windows Service Monitor	Yes			RpcSs
Windows Service Monitor	Yes			SMTPSVC
Windows Service Monitor	No			IISADMIN
Windows Service Monitor	No			IMAP4Svc
Performance Counter Monitor	Yes	Local Delivery	_Total	MSExchangeIS Transport Driver
Performance Counter Monitor	Yes	Local Queue Length	_Total	SMTP Server
Performance Counter Monitor	Yes	Remote Queue Length	_Total	SMTP Server

Find more posts tagged with

digital_signage_software

digital_signage

Accepted answers

aLTeReGo

This case has been escalated to our development team. oithim_yew, please post their findings and potential resolution once the case is closed so the rest of the community can benefit.

All comments

cgregors

doing the math:

300Mb_per_hr / 120 servers = 2.5Mb per server per hr (avg)

2.5Mb / hr = ~42Kb / min / server (avg)

Question: Are your polling rates all set to 1 minute ?

Chris.

cgregors

Whoops. didn't notice the 300Mb / 6 hours.

That would make the final number ~7K / minute / server

oithim_yew

sorry, it should be 1 exchange server utilized 300mb in the 6 hours time. we tested on one particular servers only.

cgregors

Are you using a stock APM template, or something you have crafted to match what BMC was doing?

If stock, which one?

If custom, can you post the template or at least enumerate the components and component types?

byrona

One thing I should point out...

If I am not mistaken and remembering correctly, BMC is an agent based solution. Agent based solutions will typically generate less network traffic because the agent locally on the box will do all of the collections and send the data to the management system in a much more streamlined fashion since the management system only has to communicate with the agent.

Orion is an agent-less solution, because of this it has to do polls for all of the different things it collects versus just querying an agent. When you are using APM templates this may include WMI (which has relatively high overhead) in addition to ICMP and SNMP.

oithim_yew

i had tried the downloaded template and also the ones that I had created, both having the same configurations but the downloaded ones are having more stuff. I had put the downloaded template on the same server, it seems like the utilzation is low........

mcbridea

"i had tried the downloaded template and also the ones that I had created, both having the same configurations but the downloaded ones are having more stuff. I had put the downloaded template on the same server, it seems like the utilzation is low........"

Hi oithim,

Does this mean your issue is solved or is there still a problem?

Andy

oithim_yew

mcbridea,

no, it did not solved the issue. i had tested on 2 servers with the same functions and locations. on the first server (A), i had put one of the downloaded template and one which is created by me. while on the second server (B), i had put two templates which i had created. Server A uses 1 exchange server template which I had downloaded and 1 disk/processor monitoring which I had created. Server B uses 1 exchange server and 1 disk/processor monitoring template which I had created. Both server A and B sharing the same disk/processor monitoring template.

I had turned on both servers since 5pm until now and at 3am, I had unmanaged the disk/processor monitoring templates on both servers. Server B utilzations went down while A still as high as ever.

Btw I'm using the downloaded template from thwack; Exchange-->Exchange Server 2000 and 2003

Server A

Server B

Below are the netflow readings from both server to the solarwinds server.

Server A - 172.16.1.92

Server B - 172.16.1.93

Solarwinds - 172.25.64.138

7pm to 1am (6 hrs) - Disk/processor monitoring template on both server is turned on

3am to 9am (6 hrs) - Disk/processor monitoring template on both server is turned off

mcbridea

It looks like this maybe more complicated than what we can solve here. Can you open a ticket so that support can look at this?

oithim_yew

case is logged for weeks but no solutions, support was kinda 'unprofessional' as they said that there is nothing much that they could do and we're the first to have this problem....sigh.

aLTeReGo

This case has been escalated to our development team. oithim_yew, please post their findings and potential resolution once the case is closed so the rest of the community can benefit.

oithim_yew

The result is disappointing with barely no help from solarwind support/development. After few weeks of no response, we had close the case and reduce the monitoring and add polling servers to few sites.

aLTeReGo

I'm sorry you weren't able to get your issue resolved through support. I do have some workarounds that might significantly reduce the volume of traffic that APM is generating. For starters you can monitor Windows processes and services via SNMP instead of WMI. SNMP is extremely lightweight and makes very efficient use of bandwidth. Secondly, you can use WMI to collect Windows Performance Counter data instead of RPC which tends to use the most bandwidth of any component monitor.

This change isn't simple since there's no easy conversion method. You would essentially need to recreate the templates using the different methods I proposed above, but in the long term you should be able to monitor more and utilize significantly less bandwidth in the process.