DFM Event for Broadcast - Value > 100% ?

Unanswered Question
Oct 3rd, 2007
User Badges:

What could be explanation for the below Event

++++++++++++++++++++++++++

HighBroadcastRate::Component=PORT-xx-access-sw50/1.2 [Gi0/2] [TRUNK TO DIST SWITCH];AvgInputPacketSize=0.33333334;InputPacketBroadcastPct=3.27942144E10 %;Type=ETHERNETCSMACD;InputPacketRate=1.84467437E17 PPS;InputPacketBroadcastRate=1.22978297E17 PPS;DuplexMode=FULLDUPLEX;MaxSpeed=1000000000;BroadcastThreshold=30;

+++++++++++++++++++++++++++++


If I am reading it correctly the "InputPacketBroadcastPct" is > 100% ?


How is that possible ?

I have usually seen these events when the switch Reboots. Is it because the Input packet counters are reset after the reboot and percentage calculation overflows ?


Is there a way to fix this without disabling the Broadcast threshold Alerts all together ?


Thanks,

Naman

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
Joe Clarke Wed, 10/03/2007 - 13:00
User Badges:
  • Cisco Employee,
  • Hall of Fame,

    Founding Member

The formula for this event is InputPacketBroadcastRate * AvgInputPacketSize / MaxSpeed * 100. So, (1.22 * 10^17 * 0.33) / 1000000000 * 100 which does indicate a percentage > 100. This is because DFM has determined that your receiving more traffic than the bandwidth of the interface allows. This could be indicative of a counter wrap. Did DFM detect the device was reloaded?

mnlatif Thu, 10/04/2007 - 05:02
User Badges:

It seems that it did detect the device getting Restarted.

Attached snapshots


DFM-Events --> DFM Events for the device

RME-Report --> Reload Report from RME


So the Broadcast Event was generated at 8:31:16 and a Reload Event was registered in RME before that at 8:29:44.

Though somehow I didn't see that event in DFM, Could that be the reason for the HighBroadCast Event ?

However I do see a RepeatedRestarts event on DFM at 8:37:16, so it seems that DFM was getting the traps for System-Restarted but somehow failed to co-relate this before generating the Broadcast Event ?


Thanks,

Naman





Attachment: 
Joe Clarke Thu, 10/04/2007 - 10:33
User Badges:
  • Cisco Employee,
  • Hall of Fame,

    Founding Member

RME and DFM have no relationship, so the fact that RME recorded a reload event at 8:29 means nothing. What does appear to be happening is that DFM is not detecting that the device reloaded, and uses bogus data to calculate utilization and broadcast percentage on these interfaces. This seems like a bug in that DFM is not checking the sysUpTime of the devices on each poll to determine if a wrap event may have occurred.


Unfortunately, I don't have the time to dig into this right now. You might consider opening a TAC service request to pursue this problem further.

mnlatif Thu, 10/04/2007 - 13:24
User Badges:

Thanks. Will open a TAC case for this.


\\ Naman

Martin Ermel Thu, 10/04/2007 - 23:55
User Badges:
  • Blue, 1500 points or more

and if you will get a result, don't hesitate to share it with us :-)

cebetant Wed, 09/24/2008 - 00:18
User Badges:

got that issue with DFM 2.0.9! Did you got a fix?

Joe Clarke Wed, 09/24/2008 - 12:41
User Badges:
  • Cisco Employee,
  • Hall of Fame,

    Founding Member

This problem is being addressed in DFM 3.2 which will be part of LMS 3.2 due out next summer.

Actions

This Discussion