Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 

Waht causes the NMS to record Negative utilization on a link

Hello Gurus,

One of my customer got Solarwinds network morning system. While I was trying to monitor the usage on couple of gig links ocassionally the Rx and Tx usage pops up as  '-2.1Gbps' . The number is same value (-2.1G) when it pops up. During the next 15sec interval, the utimization numbers come back to normal. Also, the  '-2.1' vlaues for Rx/Tx shows at different times. Never at same time. It may be mostly Solarwinds support question, but wondering if anyone can shed some light on this kind of behaviour. Rest of the times time the max utilization goes upto 300Meg. Also, even if the readings are true (due to burst in the link) why the '-' (neg) value?

Thanks in advance

MS

1 ACCEPTED SOLUTION

Accepted Solutions
Cisco Employee

Re: Waht causes the NMS to record Negative utilization on a link

This could happen when the octet counters wrap on the interface.  That is, if SW is looking at ifInOctets and ifOutOctets, SW will see a counter wrap when the number of input/output bytes exceeds 2^32-1.  When that happens, the counter rolls back to 0.  For high speed interfaces, NMSes should be using ifHCInOctets and ifHCOutOctets.  These are 64-bit objects, and will be much less likely to wrap.

That said, there are ways to detect counter wraps (i.e. using ifCounterDiscontinuityTime), and either discard bogus data, or attempt to calculate an accurate utilization based on the counter size.

2 REPLIES
Cisco Employee

Re: Waht causes the NMS to record Negative utilization on a link

This could happen when the octet counters wrap on the interface.  That is, if SW is looking at ifInOctets and ifOutOctets, SW will see a counter wrap when the number of input/output bytes exceeds 2^32-1.  When that happens, the counter rolls back to 0.  For high speed interfaces, NMSes should be using ifHCInOctets and ifHCOutOctets.  These are 64-bit objects, and will be much less likely to wrap.

That said, there are ways to detect counter wraps (i.e. using ifCounterDiscontinuityTime), and either discard bogus data, or attempt to calculate an accurate utilization based on the counter size.

Re: What causes the NMS to record Negative utilization on a link

Thank you Joseph. I checked the counters rollover and they were set

to 64bit. Changed it to 32bit for testing and still see the same behaviour.

But, thank you for the information. It was helpful in finding the settings.

Thanks

MS

201
Views
0
Helpful
2
Replies
CreatePlease to create content