We fixed this problem by expiring our flows in the same schedule as nfcapd does it's rotation.
On our Catalyst 6500:
mls aging long 300
Scott Dier schrieb:
> The issue at hand is that flows are sometimes received to describe a
> flow that had existed over a period of time in the past. rrd graphs
> make it difficult to add information about past information (you can
> only insert a new value every interval). In the use of rrdtool with
> nfsen there will be accurate flow volume graphs, but the other graphs
> correspond to reported packet and bit volumes for the flows reported
> within that interval, and not re-reported and averaged over the
> effective time of the flow. To fix this display problem would be an
> 'undertaking', but would lead to graphs and statistics closer to the
> actual conditions on the network. I think just getting a hold of
> alternate data (ie: cacti and snmp) for non-flow volumes may be easier. :)
>
> Thanks,
>
> Steve Foley wrote:
>> On my systems, I have some very fixed, low-bandwidth satellite links.
>> With my old MRTG-like, poll-ifInOctet.x-every-minute routine, I seemed
>> to have very accurate numbers that never exceeded my bandwidth cap.
>> When I setup nfsen with filters for these same interfaces (IN IF x), I
>> do get some values that spike over my known cap. Nothing seems to be
>> sustained above the cap, but I do see some spikes that are clearly not
>> quite right. The rest of the data seems to correlate with my old
>> system fairly well (other than only being 5 minute intervals on
>> nfsen...wish it could be 1min...) Id love to know what's up with the
>> values that are obviously wrong, but I havent had a chance to dig into
>> it.
>>
>> -Steve
>>
>> On Oct 23, 2008, at 8:06 AM, cp wrote:
>>
>>> Can anyone explain to me why my traffic graphs and the actual
>>> bandwidth usage on my circuit are different values? My goal is to
>>> find how much inet(ipv4) and mpls traffic I’m pushing. I’m using
>>> juniper gear and my rate is 100 and my run-length is 10 which means
>>> I’m sampling 10% of my traffic? I see my interfaces moving about 20m
>>> total and my graph shows about 3m of ipv4 and 1m of mpls. I can only
>>> export a single netflow version on a given box, therefore I have one
>>> router set up to export version 9 and one version 5 on a circuit
>>> between the boxes(PE to P link). How accurate are these graphs
>>> values to the actual usage? Am I missing something?
>
>
--
Dipl.-Phys. Jens Hektor, Netzbetrieb
RWTH Aachen University, Center for Computing and Communication
Room 2.07, Wendlingweg 10, 52074 Aachen (Germany)
Phone: +49 241 80 29206 - Fax: +49 241 80 22100
http://www.rz.rwth-aachen.de - [EMAIL PROTECTED]
smime.p7s
Description: S/MIME Cryptographic Signature
------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications with Moblin SDK & win great prizes Grand prize is a trip for two to an Open Source event anywhere in the world http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________ Nfsen-discuss mailing list Nfsen-discuss@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
