This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.

You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

SolarWinds NPM vs. MRTG Throughput Accuracy

travispbonfigli over 14 years ago

Hello All!

I have been trolling both thwack.com and google.com looking for some clues as to why we are seeing a huge discrepancy between the port statistics being reported by SolarWinds and what we are seeing with our MRTG installation (the MRTG has been running for years and the admin, of course, says MRTG is more accurate).

To give you some background, we are running MRTG version 2.14.7 (not the latest 2.16.3 release) on a Dell1850 with Windows2003 Standard Edition (SP2) with Perl v5.8.8 and we are running the 30-day trial version of NPM with all defaults settings on a different Dell1850 with Windows2003 Enterprise Edition (SP2). While we see the same differences with other Cisco gear, the issue that I am posting on is specifically related to our 7606 running 12.2(18) and we are looking at a GigabitEthernet port 2/4.

When we look at the MRTG data (the Daily Graph 5 Minute Average which we have been gathering for years) we are seeing it report about half of the traffic/throughput being reported by SolarWinds. For example, MRTG is reporting on gi2/4 that the average is 38Mb/sec inbound and 59Mb/sec outbound. When we look at SolarWinds, we are getting reports that show the average inbound to be 50Mb/sec and the outbound is showing 185Mb/sec. What is even more surprising is that the peak inbound/outbound being reported by MRTG is 100/120Mb/sec where SolarWinds is showing 453.43/784.39Mb/sec for the same interface.

We are truly perplexed as to how we can have such a range in what is being reported. The only information I could find was a discussion on the differences between Method 1 and Method 2 collection, but nothing specific to why such a major discrepancy would exist between the two products. We are curious if there is something we are totally missing here with respect to NPM or if MRTG is missing the mark and why? Again, your input is GREATLY appreciated and thank you!

Cheers,

Travis

0 travispbonfigli over 14 years ago

Hello All!
It looks like we have solved the mystery as to why we were seeing such a difference in the numbers being reported by MRTG when compared to SolarWinds. To recap, the MRTG numbers seemed to cap (always) at just under ~120Mb/sec. After some more searching we discovered that the difference is due to the 32-bit counters in the 5 minute interval (and if what follows is not correct, I would be interested in any feedback). The maximum amount of traffic the 32-bit counter will capture for the 5 minute interval is just shy of ~115Mb/sec. Here is the formula we found to support this claim:
(2^32) / (5*60) = x (where "x" is the maximum amount of traffic)
4,294,967,296 / 300 = x
x = 14316557.65333
Now, the formula we found said that "x" was the bytes/per second and that you then multiply this by 8 to get the BITS/per second. That was a bit confusing because we thought that 2^32 was bits, but we went with the formula as written. When doing this we end up with ~114.5Mb/sec. Ironically, this is where every GIG port we are monitoring maxes out when we look at the 5 minute interval of MRTG data (well, the graph actually shows 120Mb/sec, but you get the idea). There were a number of posts by individuals who were having similar issues with MRTG and GIG ports when using the 32-bit counters.
One of the challenges we ran into was how to determine the counter: was it 32-bit or 64-bit. According to the MRTG web site it came down to the SNMP setting in the Target string inside the mrtg config file. If the string is the following:
Target[10.xxx.x.x_7]: 7:snmpstringhere@10.xxx.x.x:
You are running SNMPv1 and by default you are using 32-bit counters. If, however, the string was set to the following:
Target[10.xxx.x.x_7]: 7:snmpstringhere@10.xxx.x.x1:::::2
You are running SNMPv2 and this will poll the MIBs for use with the 64-bit counters. There is more on this at the following link actually: mrtg.meulie.net/.../mrtg-reference.en.html
I would be interested in any feedback on this theory/formula used for the conclusion that 32-bit counters in a 5 minute view max out at right around 115Mb/sec, but it is clearly what we are seeing on our end and thank God we have SolarWinds or we would never had stumbled upon this fact. Okay, hope this helps someone out there...
Cheers,
Travis
Cancel
Vote Up 0 Vote Down

Cancel