0

Reading SNMP traffic data from network device and peridically updating RRDTool database by it. Device have very low network load (practically only OSPF plus SNMP itself packets) but graph created from RRDTool database display hundreds Mbps. Investigating in RDDTool database file discovery it contain strange values compare to SNMP counter values pushing into DB. Format of 'traf1' and 'traf2' datasources type is COUNTER. What am I doing wrong?

C:\>rrdtool.exe info "Z:\rrdfiles\ubnt\actual\10.12.101.42.rrd"
filename = "Z:\rrdfiles\ubnt\actual\10.12.101.42.rrd"
rrd_version = "0003"
step = 300
last_update = 1483622829
header_size = 8028
ds[min].index = 0
ds[min].type = "GAUGE"
ds[min].minimal_heartbeat = 600
ds[min].min = NaN
ds[min].max = 2,0000000000e+001
ds[min].last_ds = "1"
ds[min].value = 1,2980500000e+002
ds[min].unknown_sec = 0
ds[avg].index = 1
ds[avg].type = "GAUGE"
ds[avg].minimal_heartbeat = 600
ds[avg].min = NaN
ds[avg].max = 1,0000000000e+002
ds[avg].last_ds = "1"
ds[avg].value = 1,2980500000e+002
ds[avg].unknown_sec = 0
ds[max].index = 2
ds[max].type = "GAUGE"
ds[max].minimal_heartbeat = 600
ds[max].min = NaN
ds[max].max = 2,0000000000e+002
ds[max].last_ds = "3"
ds[max].value = 2,8908700000e+002
ds[max].unknown_sec = 0
ds[loss].index = 3
ds[loss].type = "GAUGE"
ds[loss].minimal_heartbeat = 600
ds[loss].min = NaN
ds[loss].max = 1,0100000000e+002
ds[loss].last_ds = "0"
ds[loss].value = 0,0000000000e+000
ds[loss].unknown_sec = 0
ds[uptime].index = 4
ds[uptime].type = "GAUGE"
ds[uptime].minimal_heartbeat = 600
ds[uptime].min = NaN
ds[uptime].max = NaN
ds[uptime].last_ds = "7"
ds[uptime].value = 9,0863500000e+002
ds[uptime].unknown_sec = 0
ds[traf1].index = 5
ds[traf1].type = "COUNTER"
ds[traf1].minimal_heartbeat = 600
ds[traf1].min = NaN
ds[traf1].max = 1,0000000000e+009
ds[traf1].last_ds = "1520759978"
ds[traf1].value = 1,3889824419e+009
ds[traf1].unknown_sec = 0
ds[traf2].index = 6
ds[traf2].type = "COUNTER"
ds[traf2].minimal_heartbeat = 600
ds[traf2].min = NaN
ds[traf2].max = 1,0000000000e+009
ds[traf2].last_ds = "15790760575"
ds[traf2].value = 1,5510842185e+010
ds[traf2].unknown_sec = 0
ds[rssi1].index = 7
ds[rssi1].type = "GAUGE"
ds[rssi1].minimal_heartbeat = 600
ds[rssi1].min = NaN
ds[rssi1].max = 1,0000000000e+002
ds[rssi1].last_ds = "46"
ds[rssi1].value = 3,6634860000e+003
ds[rssi1].unknown_sec = 50
ds[rssi2].index = 8
ds[rssi2].type = "GAUGE"
ds[rssi2].minimal_heartbeat = 600
ds[rssi2].min = NaN
ds[rssi2].max = 1,0000000000e+002
ds[rssi2].last_ds = "46"
ds[rssi2].value = 3,6634860000e+003
ds[rssi2].unknown_sec = 50
ds[signal].index = 9
ds[signal].type = "GAUGE"
ds[signal].minimal_heartbeat = 600
ds[signal].min = NaN
ds[signal].max = 1,0000000000e+002
ds[signal].last_ds = "-46"
ds[signal].value = -3,6634860000e+003
ds[signal].unknown_sec = 0
ds[rssi].index = 10
ds[rssi].type = "GAUGE"
ds[rssi].minimal_heartbeat = 600
ds[rssi].min = NaN
ds[rssi].max = 1,0000000000e+002
ds[rssi].last_ds = "50"
ds[rssi].value = 3,9820500000e+003
ds[rssi].unknown_sec = 0
ds[ccq].index = 11
ds[ccq].type = "GAUGE"
ds[ccq].minimal_heartbeat = 600
ds[ccq].min = NaN
ds[ccq].max = 1,0000000000e+002
ds[ccq].last_ds = "33"
ds[ccq].value = 2,6281530000e+003
ds[ccq].unknown_sec = 0
ds[noisef].index = 12
ds[noisef].type = "GAUGE"
ds[noisef].minimal_heartbeat = 600
ds[noisef].min = NaN
ds[noisef].max = 1,0000000000e+002
ds[noisef].last_ds = "-87"
ds[noisef].value = -6,9287670000e+003
ds[noisef].unknown_sec = 0
ds[txrate].index = 13
ds[txrate].type = "GAUGE"
ds[txrate].minimal_heartbeat = 600
ds[txrate].min = NaN
ds[txrate].max = 1,0000000000e+003
ds[txrate].last_ds = "173"
ds[txrate].value = 1,3777893000e+004
ds[txrate].unknown_sec = 0
ds[rxrate].index = 14
ds[rxrate].type = "GAUGE"
ds[rxrate].minimal_heartbeat = 600
ds[rxrate].min = NaN
ds[rxrate].max = 1,0000000000e+003
ds[rxrate].last_ds = "173"
ds[rxrate].value = 1,3777893000e+004
ds[rxrate].unknown_sec = 0
ds[cinr].index = 15
ds[cinr].type = "GAUGE"
ds[cinr].minimal_heartbeat = 600
ds[cinr].min = NaN
ds[cinr].max = 3,0000000000e+001
ds[cinr].last_ds = "30"
ds[cinr].value = 2,3892300000e+003
ds[cinr].unknown_sec = 50
rra[0].cf = "AVERAGE"
rra[0].rows = 105120
rra[0].cur_row = 65786
rra[0].pdp_per_row = 1
rra[0].xff = 0,0000000000e+000
rra[0].cdp_prep[0].value = NaN
rra[0].cdp_prep[0].unknown_datapoints = 0
rra[0].cdp_prep[1].value = NaN
rra[0].cdp_prep[1].unknown_datapoints = 0
rra[0].cdp_prep[2].value = NaN
rra[0].cdp_prep[2].unknown_datapoints = 0
rra[0].cdp_prep[3].value = NaN
rra[0].cdp_prep[3].unknown_datapoints = 0
rra[0].cdp_prep[4].value = NaN
rra[0].cdp_prep[4].unknown_datapoints = 0
rra[0].cdp_prep[5].value = NaN
rra[0].cdp_prep[5].unknown_datapoints = 0
rra[0].cdp_prep[6].value = NaN
rra[0].cdp_prep[6].unknown_datapoints = 0
rra[0].cdp_prep[7].value = NaN
rra[0].cdp_prep[7].unknown_datapoints = 0
rra[0].cdp_prep[8].value = NaN
rra[0].cdp_prep[8].unknown_datapoints = 0
rra[0].cdp_prep[9].value = NaN
rra[0].cdp_prep[9].unknown_datapoints = 0
rra[0].cdp_prep[10].value = NaN
rra[0].cdp_prep[10].unknown_datapoints = 0
rra[0].cdp_prep[11].value = NaN
rra[0].cdp_prep[11].unknown_datapoints = 0
rra[0].cdp_prep[12].value = NaN
rra[0].cdp_prep[12].unknown_datapoints = 0
rra[0].cdp_prep[13].value = NaN
rra[0].cdp_prep[13].unknown_datapoints = 0
rra[0].cdp_prep[14].value = NaN
rra[0].cdp_prep[14].unknown_datapoints = 0
rra[0].cdp_prep[15].value = NaN
rra[0].cdp_prep[15].unknown_datapoints = 0
rra[1].cf = "AVERAGE"
rra[1].rows = 1051200
rra[1].cur_row = 39803
rra[1].pdp_per_row = 5
rra[1].xff = 0,0000000000e+000
rra[1].cdp_prep[0].value = 4,0000000000e+000
rra[1].cdp_prep[0].unknown_datapoints = 0
rra[1].cdp_prep[1].value = 6,7364766667e+000
rra[1].cdp_prep[1].unknown_datapoints = 0
rra[1].cdp_prep[2].value = 1,7704723333e+001
rra[1].cdp_prep[2].unknown_datapoints = 0
rra[1].cdp_prep[3].value = 0,0000000000e+000
rra[1].cdp_prep[3].unknown_datapoints = 0
rra[1].cdp_prep[4].value = 2,8000000000e+001
rra[1].cdp_prep[4].unknown_datapoints = 0
rra[1].cdp_prep[5].value = 2,8633496716e+007
rra[1].cdp_prep[5].unknown_datapoints = 0
rra[1].cdp_prep[6].value = 2,3707567836e+008
rra[1].cdp_prep[6].unknown_datapoints = 0
rra[1].cdp_prep[7].value = 8,9847846153e+001
rra[1].cdp_prep[7].unknown_datapoints = 2
rra[1].cdp_prep[8].value = 9,0845644557e+001
rra[1].cdp_prep[8].unknown_datapoints = 2
rra[1].cdp_prep[9].value = -2,4966400000e+001
rra[1].cdp_prep[9].unknown_datapoints = 0
rra[1].cdp_prep[10].value = 2,6028800000e+001
rra[1].cdp_prep[10].unknown_datapoints = 0
rra[1].cdp_prep[11].value = 1,7529600000e+001
rra[1].cdp_prep[11].unknown_datapoints = 0
rra[1].cdp_prep[12].value = -4,5948513333e+001
rra[1].cdp_prep[12].unknown_datapoints = 0
rra[1].cdp_prep[13].value = 9,1897600000e+001
rra[1].cdp_prep[13].unknown_datapoints = 0
rra[1].cdp_prep[14].value = 9,1897600000e+001
rra[1].cdp_prep[14].unknown_datapoints = 0
rra[1].cdp_prep[15].value = 5,8899743702e+001
rra[1].cdp_prep[15].unknown_datapoints = 2
rra[2].cf = "AVERAGE"
rra[2].rows = 105120
rra[2].cur_row = 21504
rra[2].pdp_per_row = 60
rra[2].xff = 0,0000000000e+000
rra[2].cdp_prep[0].value = 2,9000000000e+001
rra[2].cdp_prep[0].unknown_datapoints = 0
rra[2].cdp_prep[1].value = 4,8360020000e+001
rra[2].cdp_prep[1].unknown_datapoints = 0
rra[2].cdp_prep[2].value = 1,0648201333e+002
rra[2].cdp_prep[2].unknown_datapoints = 0
rra[2].cdp_prep[3].value = 0,0000000000e+000
rra[2].cdp_prep[3].unknown_datapoints = 0
rra[2].cdp_prep[4].value = 2,0300000000e+002
rra[2].cdp_prep[4].unknown_datapoints = 0
rra[2].cdp_prep[5].value = 2,0276988858e+008
rra[2].cdp_prep[5].unknown_datapoints = 0
rra[2].cdp_prep[6].value = 1,6192898195e+009
rra[2].cdp_prep[6].unknown_datapoints = 0
rra[2].cdp_prep[7].value = 6,3192685679e+002
rra[2].cdp_prep[7].unknown_datapoints = 15
rra[2].cdp_prep[8].value = 6,3690843755e+002
rra[2].cdp_prep[8].unknown_datapoints = 15
rra[2].cdp_prep[9].value = -1,7221466000e+002
rra[2].cdp_prep[9].unknown_datapoints = 0
rra[2].cdp_prep[10].value = 1,7956678000e+002
rra[2].cdp_prep[10].unknown_datapoints = 0
rra[2].cdp_prep[11].value = 1,2092487000e+002
rra[2].cdp_prep[11].unknown_datapoints = 0
rra[2].cdp_prep[12].value = -3,1694801333e+002
rra[2].cdp_prep[12].unknown_datapoints = 0
rra[2].cdp_prep[13].value = 6,2624983000e+002
rra[2].cdp_prep[13].unknown_datapoints = 0
rra[2].cdp_prep[14].value = 6,2943175000e+002
rra[2].cdp_prep[14].unknown_datapoints = 0
rra[2].cdp_prep[15].value = 3,8770676286e+002
rra[2].cdp_prep[15].unknown_datapoints = 16

Exported RRDTool data: 

C:\>rrdtool.exe xport "Z:\rrdfiles\ubnt\actual\10.12.101.42.rrd"   
<xport>
      <meta>
        <start>1483613100</start>
        <step>300</step>
        <end>1483613100</end>
        <rows>13</rows>
        <columns>2</columns>
        <legend>
          <entry>tra1</entry>
          <entry>traf2</entry>
        </legend>
      </meta>
      <data>
        <row><t>1483613100</t><v>2.2345456150e+006</v><v>2.2345456150e+006</v></row>
        <row><t>1483613400</t><v>1.2072292921e+007</v><v>1.2072292921e+007</v></row>
        <row><t>1483613700</t><v>2.2444571321e+006</v><v>2.2444571321e+006</v></row>
        <row><t>1483614000</t><v>1.1981343532e+007</v><v>1.1981343532e+007</v></row>
        <row><t>1483614300</t><v>2.3354061100e+006</v><v>2.3354061100e+006</v></row>
        <row><t>1483614600</t><v>1.2097984951e+007</v><v>1.2097984951e+007</v></row>
        <row><t>1483614900</t><v>2.2187643548e+006</v><v>2.2187643548e+006</v></row>
        <row><t>1483615200</t><v>1.2097093297e+007</v><v>1.2097093297e+007</v></row>
        <row><t>1483615500</t><v>2.2196560491e+006</v><v>2.2196560491e+006</v></row>
        <row><t>1483615800</t><v>1.2104058787e+007</v><v>1.2104058787e+007</v></row>
        <row><t>1483616100</t><v>2.2126911123e+006</v><v>2.2126911123e+006</v></row>
        <row><t>1483616400</t><v>1.2066756766e+007</v><v>1.2066756766e+007</v></row>
        <row><t>1483616700</t><v>NaN</v><v>NaN</v></row>
      </data>
    </xport>

SNMP itself data (timestamp, trafx,trafy,uptime) as its readed from the device:

1483612976
.1.3.6.1.2.1.2.2.1.16.10 130854869
.1.3.6.1.2.1.2.2.1.10.10 275599423
.1.3.6.1.2.1.1.3.0 7:13:21:30.00
1483613276
.1.3.6.1.2.1.2.2.1.16.10 130906048
.1.3.6.1.2.1.2.2.1.10.10 275757426
.1.3.6.1.2.1.1.3.0 7:13:26:30.00
1483613576
.1.3.6.1.2.1.2.2.1.16.10 130912462
.1.3.6.1.2.1.2.2.1.10.10 275874209
.1.3.6.1.2.1.1.3.0 7:13:31:30.00
1483613876
.1.3.6.1.2.1.2.2.1.16.10 130963695
.1.3.6.1.2.1.2.2.1.10.10 276030574
.1.3.6.1.2.1.1.3.0 7:13:36:30.00
1483614176
.1.3.6.1.2.1.2.2.1.16.10 130970155
.1.3.6.1.2.1.2.2.1.10.10 276148573
.1.3.6.1.2.1.1.3.0 7:13:41:30.00
1483614476
.1.3.6.1.2.1.2.2.1.16.10 131021246
.1.3.6.1.2.1.2.2.1.10.10 276304600
.1.3.6.1.2.1.1.3.0 7:13:46:30.00
1483614776
.1.3.6.1.2.1.2.2.1.16.10 131027614
.1.3.6.1.2.1.2.2.1.10.10 276418563
.1.3.6.1.2.1.1.3.0 7:13:51:30.00
1483615076
.1.3.6.1.2.1.2.2.1.16.10 131078755
.1.3.6.1.2.1.2.2.1.10.10 276571254
.1.3.6.1.2.1.1.3.0 7:13:56:30.00
1483615376
.1.3.6.1.2.1.2.2.1.16.10 131085169
.1.3.6.1.2.1.2.2.1.10.10 276684807
.1.3.6.1.2.1.1.3.0 7:14:01:30.00
1483615676
.1.3.6.1.2.1.2.2.1.16.10 131136260
.1.3.6.1.2.1.2.2.1.10.10 276842586
.1.3.6.1.2.1.1.3.0 7:14:06:30.00
1483615976
.1.3.6.1.2.1.2.2.1.16.10 131142812
.1.3.6.1.2.1.2.2.1.10.10 276957811
.1.3.6.1.2.1.1.3.0 7:14:11:30.00
1483616276
.1.3.6.1.2.1.2.2.1.16.10 131193949
.1.3.6.1.2.1.2.2.1.10.10 277112644
.1.3.6.1.2.1.1.3.0 7:14:16:30.00
user2956477
  • 1,208
  • 9
  • 17

1 Answers1

0

There are two factors at play here: Rate Conversion, and Data Normalisation.

The Rate Conversion happens because you have type COUNTER. This converts the stored values to a rate, by the simple calculation (x1 - x0)/(t1 - t0), if data point x1 arrives at time t1, and so on. Because most data being monitored are increasing network byte counters, and you want to see a graph of throughput, this makes sense; however if you want to graph the actual value, use data type GAUGE. RRDTool does the rate calculation at data storage time, rather than at display time, for efficiency.

Data Normalisation is a bit harder to understand. This adjusts stored values so that they fit exactly onto the time window boundaries. RRDTool always stores data exactly in the Interval boundary, but since data could come in at any time the points need to be adjusted to fit this using a linear interpolation. The adjustments do not affect the overall totals and summaries, and are not generally noticeable with large values, but can cause confusion if using GAUGE to graph low values.

The best place to read about these is in Alex's famous tutorial, here.

Steve Shipway
  • 3,754
  • 3
  • 22
  • 39