Cisco MARS and Monitor Resource Usage

[john.stark]

Has anyone had any success using the monitor resource usage function for Cisco MARS?

How long does it take to baseline or does it baseline?

Message recieved

Device Resource Usage Anomaly: current inbound packet error rate is 90.9 percent for Device devicex at Interface 'unrouted VLAN XXX', which is much higher than the hourly average of 0.0 percent. The variance is 0.0.

Any suggestions will help.

Thanks

John Stark

[curt-wwwww]

This type of message started showing up a day or so after we turned NetFlow on.

It seemed alarming as some of them indicated very high utilization. I created a report to monitor this, generating every hour and put it into "My Reports".

The report(s) showed that these high utilizations occurred, but only for short durations. I don't know whether you would consider this to be a "success", but it was for me. I now know that I probably don't have to take any remedial action unless I see some "tall-and-wide" red/other zone(s) on the graphic.

The report was configured for "total view", but you can click the "peak view" when looking at the report and see the magnitude/duration of the occurrences.

[john.stark]

What I am talking about is differnt than the netflow reports of high utilization. It has to do with Cisco MARS monitoring of the device.

Go to the device admin, there is a selection to monitor resource usage. I have attached screen shot.

Thanks

John

[curt-wwwww]

I have the "yes" option selected ... I thought that was the reason I was getting the high inbound/outbound/CPU utilization events.

I guess I still don't have this figured-out.

[john.stark]

That would make sense for high inbound/outbound/CPU utilization events.

Wish it was clear in the documentation on the effect of 'yes'.

[rmeans]

I am not sure the original question was answered or at least if there is an answer, I am not seeing it or understand it. Either way, I am having similar trouble. I don't understand what is causing these errors or where to find them. When I get a similar Mars alarm specifying a physical interface (g1/1), it is pretty easy to find the errors (show interf g1/1) and work towards a solution.

What is causing the unrouted vlan errors and can I see them with a show command?

Message received

%MARS-1-101067 Device Resource Usage Anomaly: current inbound packet error rate is 10.2 percent for Device cat6513 at Interface 'unrouted VLAN 7', which is much higher than the hourly average of 0.1 percent. The variance is 0.8. (Device access IP: 192.168.102.1).

Thanks

[mhellman]

http://groups.google.com/group/cs-mars-ug/browse_thread/thread/9431fe079f7245ef?hl=en-GB

[rmeans]

I have not been able to access the news group. Is there any way you could grant access for me? I created a Google account and submitted a request for access last Friday.

[mhellman]

The guy that manages membership is usually pretty responsive. Here's what was posted (by Alec Waters, I just remembered reading it).

> =================================================================

> Interface Ingress Error Rate Abnormally High

> %MARS-1-101067 Device Resource Usage Anomaly: current inbound packet

> error rate is 18.4 percent for Device alastair-test2 at Interface

> 'inside', which is much higher than the hourly average of 8.3 percent.

> The variance is 14.8. (Device access IP: 10.100.1.1).

> =================================================================

> Now of course, there aren't any such interface errors (I'd be

> horrified/fired if the hourly average for input errors was 8.3%!)

> After an SR with Cisco, it turns out that the wording isn't quite

> correct. It actually translates as this (snippet of conversation from SR):

> > I've done some researches on the error message you are seeing. From

> > what I've found, and I agree it is a bit misleading, the error in

> > this message report an increase in the used bandwidth of an interface

> > not the incoming error rate. So the message you have on the Mars

> > means:

> >> %MARS-1-101067 Device Resource Usage Anomaly: Error : current

> >> inbound packet rate is 18.4 percent for Device alastair-test2 at

> >> Interface 'inside', which is much higher than the hourly average of

> >> 8.3 percent. The variance is 14.8. (Device access IP: 10.100.1.1).

> So the incident title should be read as:

> Interface Ingress Error -> Rate Abnormally High

> Not:

> "Interface Ingress Error Rate" Abnormally High

> ...if you see what I mean!