cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
769
Views
5
Helpful
7
Replies

DFM Event for Broadcast - Value > 100% ?

mnlatif
Level 3
Level 3

What could be explanation for the below Event

++++++++++++++++++++++++++

HighBroadcastRate::Component=PORT-xx-access-sw50/1.2 [Gi0/2] [TRUNK TO DIST SWITCH];AvgInputPacketSize=0.33333334;InputPacketBroadcastPct=3.27942144E10 %;Type=ETHERNETCSMACD;InputPacketRate=1.84467437E17 PPS;InputPacketBroadcastRate=1.22978297E17 PPS;DuplexMode=FULLDUPLEX;MaxSpeed=1000000000;BroadcastThreshold=30;

+++++++++++++++++++++++++++++

If I am reading it correctly the "InputPacketBroadcastPct" is > 100% ?

How is that possible ?

I have usually seen these events when the switch Reboots. Is it because the Input packet counters are reset after the reboot and percentage calculation overflows ?

Is there a way to fix this without disabling the Broadcast threshold Alerts all together ?

Thanks,

Naman

7 Replies 7

Joe Clarke
Cisco Employee
Cisco Employee

The formula for this event is InputPacketBroadcastRate * AvgInputPacketSize / MaxSpeed * 100. So, (1.22 * 10^17 * 0.33) / 1000000000 * 100 which does indicate a percentage > 100. This is because DFM has determined that your receiving more traffic than the bandwidth of the interface allows. This could be indicative of a counter wrap. Did DFM detect the device was reloaded?

It seems that it did detect the device getting Restarted.

Attached snapshots

DFM-Events --> DFM Events for the device

RME-Report --> Reload Report from RME

So the Broadcast Event was generated at 8:31:16 and a Reload Event was registered in RME before that at 8:29:44.

Though somehow I didn't see that event in DFM, Could that be the reason for the HighBroadCast Event ?

However I do see a RepeatedRestarts event on DFM at 8:37:16, so it seems that DFM was getting the traps for System-Restarted but somehow failed to co-relate this before generating the Broadcast Event ?

Thanks,

Naman

RME and DFM have no relationship, so the fact that RME recorded a reload event at 8:29 means nothing. What does appear to be happening is that DFM is not detecting that the device reloaded, and uses bogus data to calculate utilization and broadcast percentage on these interfaces. This seems like a bug in that DFM is not checking the sysUpTime of the devices on each poll to determine if a wrap event may have occurred.

Unfortunately, I don't have the time to dig into this right now. You might consider opening a TAC service request to pursue this problem further.

Thanks. Will open a TAC case for this.

\\ Naman

and if you will get a result, don't hesitate to share it with us :-)

got that issue with DFM 2.0.9! Did you got a fix?

This problem is being addressed in DFM 3.2 which will be part of LMS 3.2 due out next summer.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: