This content has been marked as final. Show 1 reply
Don't be too quick to ignore your intuition. Keep in mind that averages are just that, averages. I believe, even at its most detailed setting, averages are over a 5 minute period of time. You can (as you witnessed with your peaks) have several periods of traffic bursts that does in fact over run your bandwidth but if they are mixed in with mostly periods that are closer to idle, your average reading can be quite misleading. Even the so called "peaks" you are seeing can be somewhat misleading. By default, your nodes are only polled every 2 minutes and stats are collected only every 10. At best, you can set this to 1 minute. So that's still really an average of the 60 opportunities you had to go over the 1.5Mb/sec that your T1 can handle. I would look more at buffer overruns, errors, and discards. Errors and discards you can see in NPM. To look at overruns, you'll have to either get on the router and do a sh int s? command. There's probably a Cisco MIB to read that info but I'm not sure which one it is. You could run the MIB Walk tool on the router and have it walk the "Private" MIB tree. Then go through and look for something like buffer or overrun. It looks like maybe OID 188.8.131.52.184.108.40.206.220.127.116.11.x and ...1.27.x might be what you're looking for???. locIfInputQueueDrops.x and locIfOutputQueueDrops.x, respectively. Personally though, I'd just get right on the router and look. I've found that SNMP is great for monitoring for network anomolies but for troubleshooting specific problems such as you have, the CLI of the device is the best way to go. Assuming you've never cleared the counters on the interface, I wouldn't put too much stock in the initial reading as it will be everything since the router was last booted. Just do a clea count s? from enable mode then go back and look after a day or so.