11-14-2006 09:47 AM - edited 03-10-2019 03:19 AM
Has anyone had any success using the monitor resource usage function for Cisco MARS?
How long does it take to baseline or does it baseline?
Message recieved
Device Resource Usage Anomaly: current inbound packet error rate is 90.9 percent for Device devicex at Interface 'unrouted VLAN XXX', which is much higher than the hourly average of 0.0 percent. The variance is 0.0.
Any suggestions will help.
Thanks
John Stark
11-16-2006 11:11 AM
This type of message started showing up a day or so after we turned NetFlow on.
It seemed alarming as some of them indicated very high utilization. I created a report to monitor this, generating every hour and put it into "My Reports".
The report(s) showed that these high utilizations occurred, but only for short durations. I don't know whether you would consider this to be a "success", but it was for me. I now know that I probably don't have to take any remedial action unless I see some "tall-and-wide" red/other zone(s) on the graphic.
The report was configured for "total view", but you can click the "peak view" when looking at the report and see the magnitude/duration of the occurrences.
11-17-2006 01:52 PM
11-18-2006 12:30 PM
I have the "yes" option selected ... I thought that was the reason I was getting the high inbound/outbound/CPU utilization events.
I guess I still don't have this figured-out.
11-20-2006 08:28 AM
That would make sense for high inbound/outbound/CPU utilization events.
Wish it was clear in the documentation on the effect of 'yes'.
08-24-2007 07:45 AM
I am not sure the original question was answered or at least if there is an answer, I am not seeing it or understand it. Either way, I am having similar trouble. I don't understand what is causing these errors or where to find them. When I get a similar Mars alarm specifying a physical interface (g1/1), it is pretty easy to find the errors (show interf g1/1) and work towards a solution.
What is causing the unrouted vlan errors and can I see them with a show command?
Message received
%MARS-1-101067 Device Resource Usage Anomaly: current inbound packet error rate is 10.2 percent for Device cat6513 at Interface 'unrouted VLAN 7', which is much higher than the hourly average of 0.1 percent. The variance is 0.8. (Device access IP: 192.168.102.1).
Thanks
08-24-2007 09:59 AM
08-27-2007 06:28 AM
I have not been able to access the news group. Is there any way you could grant access for me? I created a Google account and submitted a request for access last Friday.
08-27-2007 06:38 AM
The guy that manages membership is usually pretty responsive. Here's what was posted (by Alec Waters, I just remembered reading it).
> =================================================================
> Interface Ingress Error Rate Abnormally High
> %MARS-1-101067 Device Resource Usage Anomaly: current inbound packet
> error rate is 18.4 percent for Device alastair-test2 at Interface
> 'inside', which is much higher than the hourly average of 8.3 percent.
> The variance is 14.8. (Device access IP: 10.100.1.1).
> =================================================================
> Now of course, there aren't any such interface errors (I'd be
> horrified/fired if the hourly average for input errors was 8.3%!)
> After an SR with Cisco, it turns out that the wording isn't quite
> correct. It actually translates as this (snippet of conversation from SR):
> > I've done some researches on the error message you are seeing. From
> > what I've found, and I agree it is a bit misleading, the error in
> > this message report an increase in the used bandwidth of an interface
> > not the incoming error rate. So the message you have on the Mars
> > means:
> >> %MARS-1-101067 Device Resource Usage Anomaly: Error : current
> >> inbound packet rate is 18.4 percent for Device alastair-test2 at
> >> Interface 'inside', which is much higher than the hourly average of
> >> 8.3 percent. The variance is 14.8. (Device access IP: 10.100.1.1).
> So the incident title should be read as:
> Interface Ingress Error -> Rate Abnormally High
> Not:
> "Interface Ingress Error Rate" Abnormally High
> ...if you see what I mean!
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide