[j-nsp] cflowd oversample warning ?

From: Jim Warner (warner@cats.UCSC.EDU)
Date: Tue Mar 05 2002 - 17:19:34 EST


Running cflowd export on our first M-10, I found lots of
the following error messages in the Juniper messages log files.

Jan 11 19:26:34 QSV-Juniper tnp_scb SM: samples dropped due to high packet rate
Jan 11 19:31:34 QSV-Juniper tnp_scb SM: samples dropped due to high packet rate
Jan 11 19:41:45 QSV-Juniper tnp_scb last message repeated 2 times
Jan 11 19:51:47 QSV-Juniper tnp_scb last message repeated 2 times

Interface data reconsituted from the cflowd exports looked
like it suffered from peak clipping. This is
JUNOS 4.4R3.4 built 2001-08-04

That was not really a surprise. We changed the
sampling "rate" from 100 to 400. That made the
tnp_scb error messages go away and fixed derived
interface stats that we calculate from cflowd data
so they agreed with SNMP interface data.

On our second M-10, I also observed peak clipping.
When I made the same change (rate 100 ==> rate 400)
the clipping disappeared. My problem is that the
second M-10 has never showed me an error message
even though all evidence suggests it was dropping
samples. This is JUNOS 5.0R2.4 built 2001-09-25

I would sure feel better about all this if I knew
that monitoring the log files was sufficient warning
about the onset of sample dropping. But there's something
about Juniper logs that I don't understand.

So, my question is: What controls which reports
are added to the messages file?

I looked in the JunOS release notes and I can't find
anything that might be a bug notice in what should be
a fairly mature release.

-jim warner
U.C. Santa Cruz



This archive was generated by hypermail 2b29 : Mon Aug 05 2002 - 10:42:39 EDT