[c-nsp] real time polling & graphing

[Sam Stickland]

Daniel Hooper wrote:
> Hi,
>
> I'm currently using Cacti to graph my interfaces, this doesn't seem to
> be real time enough.
>
> What are others using for graphing and data collection?
>
> I was playing around with the realtime plugin for Cacti this morning,
> comparing the graphs taken with 5 second polling and graphs taken with
> 60 second polls, I'm seeing a huge difference, one link I thought was
> hovering around 10mbit is actually peaking around 20mbit.
>
> -Dan
>
>   
Hi Dan,

It can get very processor intensive real quick - not just on your 
graphing host, but on the switches as well. In fact, I think a lot of 
Cisco devices only update their SNMP counters every 10 seconds.

While it can be useful to look at a suspect link in more detail, 
ultimately I think you will find that you have to accept some kind of 
level of averaging. Consider that on a 100Mbit Ethernet link, the 'most' 
realtime graph would simply alternative between complete inactivity and 
'bursts' of 100Mbit, simply because this is line rate of the link. It's 
simply impossible for it to be transmitting at other speeds :)

This is why you hear people say things like "upgrade your ethernet links 
when they reach 70% [on a five minute average]", because this is a 
guestimate of the point where the link is starting to get saturated (on 
smaller timer intervals).

So, to answer your question - what do we use for realtime graphing - as 
a rule, we don't. :) However, there are other some other useful metrics 
you can look at, such as output queue drops, queue depth and buffer 
utilisation (but make sure your version of IOS is reporting these 
correctly).

If you suspect a link is getting close to full, here's a suggestion 
that's been brought up on this list a few times. Put a policer on the 
link, but with the exceed and violate actions set to transmit. Now by 
adjusting Tc (or at least knowing - it's fixed to 125ms on some 
platforms) you can see what rate it is overrunning on time intervals 
quite a bit smaller than you can graph via SNMP.

Sam