Waht causes the NMS to record Negative utilization on a link

[mvsheik123]

Hello Gurus,

One of my customer got Solarwinds network morning system. While I was trying to monitor the usage on couple of gig links ocassionally the Rx and Tx usage pops up as  '-2.1Gbps' . The number is same value (-2.1G) when it pops up. During the next 15sec interval, the utimization numbers come back to normal. Also, the  '-2.1' vlaues for Rx/Tx shows at different times. Never at same time. It may be mostly Solarwinds support question, but wondering if anyone can shed some light on this kind of behaviour. Rest of the times time the max utilization goes upto 300Meg. Also, even if the readings are true (due to burst in the link) why the '-' (neg) value?

Thanks in advance

MS

[Joe Clarke · Accepted solution]

This could happen when the octet counters wrap on the interface.  That is, if SW is looking at ifInOctets and ifOutOctets, SW will see a counter wrap when the number of input/output bytes exceeds 2^32-1.  When that happens, the counter rolls back to 0.  For high speed interfaces, NMSes should be using ifHCInOctets and ifHCOutOctets.  These are 64-bit objects, and will be much less likely to wrap.

That said, there are ways to detect counter wraps (i.e. using ifCounterDiscontinuityTime), and either discard bogus data, or attempt to calculate an accurate utilization based on the counter size.

[mvsheik123]

Thank you Joseph. I checked the counters rollover and they were set

to 64bit. Changed it to 32bit for testing and still see the same behaviour.

But, thank you for the information. It was helpful in finding the settings.

Thanks

MS