This is two questions on the same subject:
I have several interfaces monitored and the graph is detailing minimum/maximum/average
Polling is every 9 minutes and detailed in the graph every 15 minutes
My question - if the maximum on the graph is displayed at 762 Mbps is that really the maximum or in the 15 minutes could it have gone higher.
I know this sounds like a stupid question, but I also have a second scenario;
I also have a vendor monitoring an MPLS link which is experiencing drops (Not huge quantity, but still I do not expect them) and they are detailing the following on a 20Mb link which is not showing 100% utilized, in fact, traffic is occasionally hitting 14Mbps. I am wondering whether there graph would be better as a minimum / maximum / average, but only if the maximum is really the maximum.
for reference, their graphs are: and they are detailing the following:
Comments from Vendor monitoring our Link:
[Comment from Vendor]
I have reviewed this case with a colleague and the opinion at the moment is that the discards seen in the period 04:00hrs - 12:00hrs are simply due to microbursts of traffic from the site. Whilst we can configure the load-interval value on the router interface down to 30 seconds, this is still far too long to capture any microbursts of traffic.
We have used a real-time bandwidth monitor which can provide a snapshot of traffic utilisation on the link and I have run this against the router today to get an idea of traffic levels. This has shown a number of spikes in transmit utilisation lasting just a few seconds at various times throughout the day. Whilst we can poll the interface at this relatively short interval (~2s), it is not always possible to see microbursts of traffic even at this level, although we can get a fair idea of the traffic levels.
Microbursts are patterns or spikes of traffic that take place in a relatively short time interval (generally sub-second) causing network interfaces to temporarily become oversubscribed and drop traffic.
Looking at the bandwidth monitor this evening (16:00hrs GMT onwards), we are seeing general low levels of traffic (presumably as the site is now closed), however about every 5 minutes we see a short sharp burst in transmit traffic of about 8 - 10Mbps (examples attached). In comparison, our monitoring servers will poll for SNMP data every 10 minutes and then average the data so any short sharp spikes in data will not be seen.
Looking at the interface counters (since they were last reset upon reboot 18wks ago), the number of output drops equate to ~0.12% of all data sent through the link. Any TCP traffic should have been automatically re-transmitted by the host once it was notified that the packet had not been received.
I hope someone can assist.