DFM Event for Broadcast - Value > 100% ?

Unanswered Question
Oct 3rd, 2007

What could be explanation for the below Event

++++++++++++++++++++++++++

HighBroadcastRate::Component=PORT-xx-access-sw50/1.2 [Gi0/2] [TRUNK TO DIST SWITCH];AvgInputPacketSize=0.33333334;InputPacketBroadcastPct=3.27942144E10 %;Type=ETHERNETCSMACD;InputPacketRate=1.84467437E17 PPS;InputPacketBroadcastRate=1.22978297E17 PPS;DuplexMode=FULLDUPLEX;MaxSpeed=1000000000;BroadcastThreshold=30;

+++++++++++++++++++++++++++++

If I am reading it correctly the "InputPacketBroadcastPct" is > 100% ?

How is that possible ?

I have usually seen these events when the switch Reboots. Is it because the Input packet counters are reset after the reboot and percentage calculation overflows ?

Is there a way to fix this without disabling the Broadcast threshold Alerts all together ?

Thanks,

Naman

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
Joe Clarke Wed, 10/03/2007 - 13:00

The formula for this event is InputPacketBroadcastRate * AvgInputPacketSize / MaxSpeed * 100. So, (1.22 * 10^17 * 0.33) / 1000000000 * 100 which does indicate a percentage > 100. This is because DFM has determined that your receiving more traffic than the bandwidth of the interface allows. This could be indicative of a counter wrap. Did DFM detect the device was reloaded?

mnlatif Thu, 10/04/2007 - 05:02

It seems that it did detect the device getting Restarted.

Attached snapshots

DFM-Events --> DFM Events for the device

RME-Report --> Reload Report from RME

So the Broadcast Event was generated at 8:31:16 and a Reload Event was registered in RME before that at 8:29:44.

Though somehow I didn't see that event in DFM, Could that be the reason for the HighBroadCast Event ?

However I do see a RepeatedRestarts event on DFM at 8:37:16, so it seems that DFM was getting the traps for System-Restarted but somehow failed to co-relate this before generating the Broadcast Event ?

Thanks,

Naman

Attachment: 
Joe Clarke Thu, 10/04/2007 - 10:33

RME and DFM have no relationship, so the fact that RME recorded a reload event at 8:29 means nothing. What does appear to be happening is that DFM is not detecting that the device reloaded, and uses bogus data to calculate utilization and broadcast percentage on these interfaces. This seems like a bug in that DFM is not checking the sysUpTime of the devices on each poll to determine if a wrap event may have occurred.

Unfortunately, I don't have the time to dig into this right now. You might consider opening a TAC service request to pursue this problem further.

Joe Clarke Wed, 09/24/2008 - 12:41

This problem is being addressed in DFM 3.2 which will be part of LMS 3.2 due out next summer.

Actions

This Discussion