Why is interface utilization 25k% over what it should be?

Hi wluther,

can you check if you did not set custom bandwith? Also you could check what in/out data are stored in DB for the time when utilization shows the peak. It can be that the device returns a value which is wrongly interpreted.

Thanks,

Pavel

Will,

The Percent Utilization is actually a calculation of the {Current In/Out Bandwidth} / {InterfaceBandwidth} x 100%.

Sometimes the SNMP will show up that the Interface Bandwidth is not exactly the value that you are having e.g. Interface Bandwidth is showing 10Mbps, but the device is in fact having 1Gbps traffic going through the interface.

If the interface is in fact 1Gbps, the 64-bit counter will come into play.

Without 64-bit counters, we will use 32bit counters - ifInOctets/ifOutOctets. With 64-bit, it will be using ifHCInOctets/ifHCOutOctet.

Difference in the OID is that 32-bit counters having only 2^32 as a maximum value, anything more will cause a overflow. 64-bit will be able to work with a bigger digit, 2^64.

So, the first thing you should confirm is that the Interface Bandwidth is correct. If it is not, you can modify the interface, and assign a Custom Interface Bandwidth.

Confirm the In/Out bandwidth is it is correct. And confirm if the In/Out is exceeding the Interface Bandwidth that your device supported.

For some WAN interfaces (to the Internet), ISP provides bursting service, that will allow you to go above the Interface Bandwidth that you are allocated. But 25K% is too big a value to consider for bursting.

HTH.

if this is a network device, then the bandwidth statement on the box may be incorrect. This often happens when a WIC is initially set up for 1Mbps and the circut is subsequently upgraded to 10 or whatever. SolarWinds reads in teh bandwidth statement and uses that as the "100%" value for bandwidth metrics.

have you tried checking allow 64 bit counters rather than unchecking it.

I have manually set the bandwidth to 1Gbps, to match the interface speed.  I originally thought this would fix the issue, but it had continued.

I am not sure where to go within the DB, nor am I sure what exactly I would be looking for.  But, I can look and tell you, if you can provide me the instructions telling me where I need to look and what commands to use.

Thank you,

-Will

The issue is occurring on 1Gbps interfaces, all of which are correctly and manually set within NPM.

We did "uncheck" the 64-bit counter option on a few of the 1Gbps interfaces/devices today, and have not seen them come back in error.  We will continue to monitor it over the next week or so just in case.

All of the interfaces having this issue are 1Gbps interfaces with a 1Gbps Interface Bandwidth & Configured Interface Speed.

It appears the extremely high utilization % error has not shown up in the events since unchecking the 64 bit counter option, however, the MAC address is still showing an incorrect string of characters, as well as showing more characters than it should.

Hi wluther,

to see what data were polled do following steps:

1. Go to Interface Details of the interface with high utilization.

2. See the Total Bytes Transferred resource and click on Export button.

3. Set the Sample Interval to your interface polling interval (10 minutes by default) and click Refresh button.

4. Click Export to HTML button.

5. You should see the table with polled data on this interface.

Try to look for extra big numbers in the table. Those can be the peaks which are causing the super high utilization.

You can also run following query in your DB where xxx is interface id of the interface with high utilization:

Select [DateTime], [In_TotalBytes], [Out_TotalBytes] FROM [SolarWindsOrion].[dbo].[InterfaceTraffic_Detail] where InterfaceId='xxx'

If you find those peaks then you should investigate why your device is returning those values.

Cheers,

Pavel

See the example.

I reported this same problem years ago and I don't know that it was ever resolved.

Rick

Will,

Can you do a snmpwalk and verify if the ifPhysAddress is showing the correct MAC Address?

http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?local=en&translate=Translate&objectInput=1.3.6.1.2.1.2.2.1.6

On the newer versions of NPM, snmpwalk is located under Program Files (x86)\SolarWinds\Orion\

Alternatively, you can get it from this KB - http://knowledgebase.solarwinds.com/kb/questions/3145/SolarWinds+SNMP+Walk%3A+A+new+tool+for+collecting+SNMP+MIB+walks

NPM retrieve the information from the SNMP agent. Thus, we have to ensure that the device is returning legitimate information, so that we can isolate where the issue might be with.