Windows network SNMP traffic overflow?

Question

How would I go about retrieving 64 bit counters for network traffic on windows (Server 2008 specifically)? I'm seeing too many rollovers on the 32 bit counters for our polling interval, leading to gaps in the data.

We feed the data through RRDTool, which can successfully handle one rollover per polling period, but can't deal with two. 64bit counters would prevent this issue, but I can't seem to find a way to enable them on windows

Can your graphing tool only poll SNMP? I had to use WMI or RPC to access perfmon counters in Zenoss, fixed this for me. — SpacemanSpiff, Apr 05 '11 at 15:55

score 3 · Accepted Answer · answered Apr 05 '11 at 15:43

3

According to Tiger Li, a moderator on Microsoft's TechNet, it's not possible:

http://social.technet.microsoft.com/Forums/en-CA/winservergen/thread/07b62ff0-94f6-40ca-a99d-d129c1b33d70

answered Apr 05 '11 at 15:43

Keith

4,637
15
25

If anyone stumbles on this... I believe the only way to do this is via the 3rd party Informant SNMP agent: http://www.snmp-informant.com/ – Keith Dec 24 '11 at 05:37
snmp-informant won't work well because it doesn't use counters like the natvice 32-bit snmp--it uses deltas (that is, its output is Bytes/sec). So it you poll every 5 min, and download a huge file for the middle 3 minutes of an otherwise idle connection, at both poll times the Bytes/sec value will be 0. You need an absolute like BytesReceived which the 32-bit snmp counter gave you. – Ryan Horrisberger Mar 18 '13 at 18:36

score 0 · Answer 2 · answered Apr 05 '11 at 15:47

0

In general these would be keep in the HC counters: IF-MIB::ifHCInOctets

If you can't pull these from Windows, I think your best bet might to be if your switch has these counters in their IF-MIB table and pull it from there.

answered Apr 05 '11 at 15:47

Kyle Brandt

83,619
74
305
448

score 0 · Answer 3 · edited Apr 13 '17 at 12:14

0

Although there are no 64-bit SNMP counters on Windows (as Keith mentioned), and perfmon counters won't give reliable information because they are already rate values (bytes/sec) if you don't mind installing nsclient you can pretty easily use WMI

edited Apr 13 '17 at 12:14

Community

1

answered Mar 20 '13 at 15:52

Ryan Horrisberger

159
4

We ended up writing our own SNMP agent to return the 64bit counters. WMI would have required throwing away all our existing monitoring infrastructure. – devicenull Mar 20 '13 at 19:28

Windows network SNMP traffic overflow?

3 Answers3

Linked