I've seen this happen all the time when using log file format on busy systems, though usually my spikes are impossibly large (greater than 4Tbps), so I have a script that runs periodically and trims down spikes that are larger than MaxBytes. For spikes that are less than MaxBytes, though, I'm at a bit of a loss, since my script wouldn't be able to identify them as erroneous. I think I'd want to run some other tool first to really verify whether they might be legitimate traffic volumes or not, and then proceed from there.
Matt ----- Original Message ---- From: Steve Shipway <[email protected]> To: Ed LaFrance <[email protected]>; "[email protected]" <[email protected]> Sent: Wed, September 30, 2009 2:10:34 PM Subject: Re: [mrtg] Strange phantom spikes in graphs > I just recently set up MRTG monitoring of one such installation a few > days ago, and right away I began noticing strange traffic spikes > appearing on the WAN and trunk router interfaces: sharp, narrow > spikes of 60Mbps or more once or twice per day, Possible causes - 1) You are running MRTG inside a Virtual Machine (Xen, VMware, etc). These cause clock skew and mess up calculations. Don't do it. 2) Try running using SNMPv2 and see if this helps (although your traffic does not seem to be high enough for this to be the cause) 3) There really IS this traffic pattern. Possibly there is a periodic broadcast storm, or ping flood, or huge SNMP traffic to the device, or something. Unlikely but may be worth checking. 4) There is a fault in your router. Unlikely. 5) Something else? Steve _______________________________________________ mrtg mailing list [email protected] https://lists.oetiker.ch/cgi-bin/listinfo/mrtg _______________________________________________ mrtg mailing list [email protected] https://lists.oetiker.ch/cgi-bin/listinfo/mrtg
