What should a charting tool look like if the SNMP counter is less important than the previous reading?

Question

I am creating a small monitoring solution and want to understand what is the correct / best behavior in a situation where the previous reading is larger than the current one. For example, ifHCOutOctets The SNMP object counts the bytes sent from the interface in the Cisco router. What should a graphical display application look like if this counter is reset back to 0, for example, due to a router reboot? In my version, the following algorithm is the correct behavior:

 if [ ! $prev_val ]; then # This reading will be used to set the baseline value for "prev_val" variable # if "prev_val" does not already exist. prev_val="$cur_val" elif (( prev_val > cur_val )); then # Counter value has set to zero. # Use the "cur_val" variable. echo "$cur_val" prev_val="$cur_val" else # In case "cur_val" is higher than or equal to "prev_val", # use the "cur_val"-"prev_val" echo $(( cur_val - prev_val )) prev_val="$cur_val" fi 

I also made a small sample graph based on the above algorithm:

A traffic graph was built based on this:

 reading 1: cur_val=0, prev_val will be 0 reading 2: 0-0=0(0 Mbps), cur_val=0, prev_val will be 0 reading 3: 20-0=20(160 Mbps), cur_val=20, prev_val will be 20 reading 4: 20-20=0(0 Mbps), cur_val=20, prev_val will be 20 reading 5: 50-20=30(240 Mbps), cur_val=50, prev_val will be 50 reading 6: 40(320Mbps), cur_val=40, prev_val will be 40 reading 7: 70-40=30(240 Mbps), cur_val=70, prev_val will be 70 reading 8: no data from SNMP agent reading 9: 90-70=20(160 Mbps), cur_val=90, prev_val will be 90 

It seems to me that this little algorithm works correctly.

Please let me know if something is unclear, I will improve my question.

Answer 1

The problem that I see that you are echoing is that in the case of normal operation, the counter changes. After rebooting the router, it will show some absolute value. Now you can compare them. 2. If you want to show delta 2 readings, I would suggest:

 if [ ! $prev_val ]; then # This reading will be used to set the baseline value for "prev_val" variable # if "prev_val" does not already exist. prev_val="$cur_val" elif (( prev_val > cur_val )); then # Counter value has set to zero. # Use the "cur_val" variable. echo "Router/counter restarted" # restart the counter as well prev_val="$cur_val" else # In case "cur_val" is higher than or equal to "prev_val", # use the "cur_val"-"prev_val" echo $((cur_val-prev_val)) fi 

You can also delete the elif part and simply print a negative value to indicate the counter / router is restarting

Answer 2

In particular, if the sampling type is "Counter32", it is worth considering that the counters are rolling. I'm not sure if this is “best practice,” but when you know that you have a partial sample, you can also extrapolate a piece of data from your sample, as if you were maintaining the same rate of increase throughout your sample. If your data is not very complete, this should make for a smoother graph.

 partial_calc = $((sample_time - ifCounterDiscontinuityTime)); if ("$interval" -gt "$partial_calc") { sample = $((curr_val * interval / partial_check)) } elif "$curr_val" -gt "$prev_val" { sample = $((curr_val - prev_val)); } else { if ("$type" -eq "Counter32") { sample = $((4294967295 - prev_val + curr_val)); } else { sample = $curr_val; } }