Percent network Utilization Graph of interface

[kloczek]

IF-MIB provides all necessary OIDs with data which can be used to generate such calculations.
IF-MIB::if{In,Out}Octets or IF-MIB::ifHC{In,Out}Octets provides information about transferred in/out data and IF-MIB::ifSpeed provides interface max speed.

http://www.oidview.com/mibs/0/IF-MIB.html

IF-MIB is used on all network devices so it wiill be working not only on Cisco.

[grmnrvs]

IF-MIB provides all necessary OIDs with data which can be used to generate such calculations.
IF-MIB::if{In,Out}Octets or IF-MIB::ifHC{In,Out}Octets provides information about transferred in/out data and IF-MIB::ifSpeed provides interface max speed.

http://www.oidview.com/mibs/0/IF-MIB.html

IF-MIB is used on all network devices so it wiill be working not only on Cisco.

Hi Kloczek

With these data i can write a calculated item formula?

[kloczek]

Hi Kloczek

With these data i can write a calculated item formula?

Yes of course. However I would hold for few seconds before doing this to really ask the question: why do you want to calculate such percentage values?
IMO it make sense to calculate such values only if you want o use them to use in triggers.
On presentation layer in graphs you can just add values red from interfaces ifSpeed to use in graph mapped value "Y axis MAX value".
Simple it is always the cost of calculating something and evaluating in the trigger.
With plotting horizontal line there is no such cost.

[grmnrvs]

Yes of course. However I would hold for few seconds before doing this to really ask the question: why do you want to calculate such percentage values?
IMO it make sense to calculate such values only if you want o use them to use in triggers.
On presentation layer in graphs you can just add values red from interfaces ifSpeed to use in graph mapped value "Y axis MAX value".
Simple it is always the cost of calculating something and evaluating in the trigger.
With plotting horizontal line there is no such cost.

Well, I'll be a bit extensive, but here's my answer.

In our company we provide a critical communications service which will be updated soon in terms of communications and data infrastructure. This update will incorporate 47 HP brand switches to the 5 Cisco equipment currently in use.

The HP brand switches will connect to each other through dedicated 12 Mbps links, and this is where Zabbix comes in, since we want to know how much bandwidth percentage is consumed on each of those dedicated links. As I understand one way to calculate the percentage of bandwidth consumed is to add all the incoming and outgoing traffic of the interfaces you are using in each of the switches, perhaps this confused or wrong, it is for this reason that I have opened again this post.

If you see at the beginning of this post, you will see that the user ssalomon queries the same but in relation to a single interface of your network device, but what I need I think is a little more complex since I need to calculate incoming and outgoing traffic all the interfaces used in each switch that is connected to that 12 Mbps link.

I honestly do not know if Zabbix can provide me with that information or if I will use another network analysis and / or monitoring tool such as "Cacti + Weathermap" for example, with the wide and complete that Zabbix is, I think it can do it. Maybe there is some template or another way to calculate and graph this that I need.

I have read all the official documentation about the calculated items but it only served me for this case for example 100 * last (net.if.in [ifHCInOctets.10121]) / 1073741824 but I remind you again what I need (incoming and outgoing traffic from all interfaces). Is there any other way to obtain and graph this information?

If this could be done would be wonderful, the next step would be to generate the triggers so that in a map can change the colors of the links according to their consumption in percentages (such as "Cacti + Weathermap").

Today I am stopped and confused as to whether I should perform a calculated item or an SNMP item. The Linwood user recommended me to create two SNMP items so that each one gets the information of incoming traffic and outbound traffic, and then generate a third calculated item that adds up the total result of those items, but the truth is that at this moment I could not move forward or perform a successful test.

I do not have the experience and knowledge of you, but there are my wishes and desire to solve this betting on the use of this great tool, so you will see that I write every few days.

I have searched the internet and I have not found much specific information about what I need.
I hope you can understand me. We are in contact, thank you very much.-

NOTE: The Switchs are HP 3600 and Cisco 3560.

Look at this post

[Linwood]

The HP brand switches will connect to each other through dedicated 12 Mbps links, and this is where Zabbix comes in, since we want to know how much bandwidth percentage is consumed on each of those dedicated links. As I understand one way to calculate the percentage of bandwidth consumed is to add all the incoming and outgoing traffic of the interfaces you are using in each of the switches, perhaps this confused or wrong, it is for this reason that I have opened again this post.

I may just be dense, but it is in this area where I remain confused. I hope I do not read too much into the precise wording, but you say you want to know "how much bandwidth percentage is consumed on each of those dedicated links". Why is there any summation?

A link (singular) is connected to an interface (singular) and has an input and output bandwidth consumption, and a maximum (12 Mbps).

Yet in your discussion you seem to be adding many interface bandwidths together?

Even if you are load balancing in some fashion over multiple 12 Mbps links, would you not want to monitor each link individually, thus being able to tell if indeed the load is balanced?

I more or less quit participating in this because I felt like I did not understand the core problem and how your questions related to it, and worried my answers were adding confusion rather than substance. After reading the above I worry even more.

To take an example from a current client of mine, their network (also heavily Cisco 3560/3650 based) is connected by a web of individual microwave, fiber, and ring-protected microwave systems, with lots of path choices based on dynamic routing protocols. We monitor the bandwidth utilization on each path, where each path is terminated on one interface. There's never a need, in our case, to add anything together. Sure, we have an aggregate max bandwidth between sites that is the sum of all possible paths, but that's not really relevant -- each path saturates (or not) on its own. We monitor each path (using Cisco SLA) for performance, separately, as well, and trigger on increasing ping times.

I'm just struggling with the network management need of adding bandwidths together. I am not saying yours is not such a case -- I am saying I do not understand why it is, and so I worry any answer I may try to give will be confusing not helpful. It may be productive to those trying to help to take a real but limited example, show a diagram, and indicate what on that diagram you are trying to measure and why?

[kloczek]

Well, I'll be a bit extensive, but here's my answer.

In our company we provide a critical communications service which will be updated soon in terms of communications and data infrastructure. This update will incorporate 47 HP brand switches to the 5 Cisco equipment currently in use.

The HP brand switches will connect to each other through dedicated 12 Mbps links, and this is where Zabbix comes in, since we want to know how much bandwidth percentage is consumed on each of those dedicated links. As I understand one way to calculate the percentage of bandwidth consumed is to add all the incoming and outgoing traffic of the interfaces you are using in each of the switches, perhaps this confused or wrong, it is for this reason that I have opened again this post.

If you see at the beginning of this post, you will see that the user ssalomon queries the same but in relation to a single interface of your network device, but what I need I think is a little more complex since I need to calculate incoming and outgoing traffic all the interfaces used in each switch that is connected to that 12 Mbps link.
(..)

That is a bit different context than this one in which is possible to use ifSpeed.
This OID shows physical max bandwidth determined by port type.

Just try to check your switch using "snmpbulkwalk <snmp_proto_ver_and_auth_options> <switch_addr> IF-MIB::ifSpeed | awk '{print $4}' | sort| uniq"
Logical max bandwidth it is another story.

What it can be done in this case?
It is possible to form two types of the alarms:
- physical max bandwidth has been reached
- logical bandwidth has been reached

Both if such saturation will be longer than some predefined time.
Both (possible ) types of alarms may use some thresholds with some percentage and/or absolute values which needs to be reached (defined in template macros).

What may be wrong with use such triggers?
This still can cause some false alarms if for example in some local network someone will be doing some backups saturating max bandwidth (physical or logical).

Issue is that some switches have a lot of ports and some ports may be part of some trunks. Even if some max bandwidth will be reached this still co not be enough reason to start start alarming.

As I'm trying to maintain some IF-MIB based template which used on monitoring network ports I may try even to implement some logic to handle some cases but possible extensions of such IF-MIB template first needs to be discussed to prepare exact logic which will be used on collecting base data and implementing exact triggers logic to not produce some false alarms or produce them only in some exact conditions.

Current version of the template which I'm talking about is on https://github.com/kloczek/zabbix-te...ter/MIB/IF-MIB
Devel version is on https://github.com/kloczek/zabbix-te...vel/MIB/IF-MIB

If you want to continue this discussion please show me first result of two commands wjhich are listed on https://github.com/kloczek/zabbix-te...SNMP%20Devices to see what kinfd of informations is possible to collect on those switches.
Next part of the discussion should be related to exact logic of the monitoring and alarming layer.

I'm not 100% sure but IIRC Cisco switches may as well emit some SNMP traps if some port bandwidth has been saturated.
Collecting those traps could be as well such IF-MIB template. In some cases it may be enough.

[grmnrvs]

I may just be dense, but it is in this area where I remain confused. I hope I do not read too much into the precise wording, but you say you want to know "how much bandwidth percentage is consumed on each of those dedicated links". Why is there any summation?

A link (singular) is connected to an interface (singular) and has an input and output bandwidth consumption, and a maximum (12 Mbps).

Yet in your discussion you seem to be adding many interface bandwidths together?

Even if you are load balancing in some fashion over multiple 12 Mbps links, would you not want to monitor each link individually, thus being able to tell if indeed the load is balanced?

I more or less quit participating in this because I felt like I did not understand the core problem and how your questions related to it, and worried my answers were adding confusion rather than substance. After reading the above I worry even more.

To take an example from a current client of mine, their network (also heavily Cisco 3560/3650 based) is connected by a web of individual microwave, fiber, and ring-protected microwave systems, with lots of path choices based on dynamic routing protocols. We monitor the bandwidth utilization on each path, where each path is terminated on one interface. There's never a need, in our case, to add anything together. Sure, we have an aggregate max bandwidth between sites that is the sum of all possible paths, but that's not really relevant -- each path saturates (or not) on its own. We monitor each path (using Cisco SLA) for performance, separately, as well, and trigger on increasing ping times.

I'm just struggling with the network management need of adding bandwidths together. I am not saying yours is not such a case -- I am saying I do not understand why it is, and so I worry any answer I may try to give will be confusing not helpful. It may be productive to those trying to help to take a real but limited example, show a diagram, and indicate what on that diagram you are trying to measure and why?

Linwood, quiet you are not dense! Please, you are here to help me

That is a bit different context than this one in which is possible to use ifSpeed.
This OID shows physical max bandwidth determined by port type.

Just try to check your switch using "snmpbulkwalk <snmp_proto_ver_and_auth_options> <switch_addr> IF-MIB::ifSpeed | awk '{print $4}' | sort| uniq"
Logical max bandwidth it is another story.

What it can be done in this case?
It is possible to form two types of the alarms:
- physical max bandwidth has been reached
- logical bandwidth has been reached

Both if such saturation will be longer than some predefined time.
Both (possible ) types of alarms may use some thresholds with some percentage and/or absolute values which needs to be reached (defined in template macros).

What may be wrong with use such triggers?
This still can cause some false alarms if for example in some local network someone will be doing some backups saturating max bandwidth (physical or logical).

Issue is that some switches have a lot of ports and some ports may be part of some trunks. Even if some max bandwidth will be reached this still co not be enough reason to start start alarming.

As I'm trying to maintain some IF-MIB based template which used on monitoring network ports I may try even to implement some logic to handle some cases but possible extensions of such IF-MIB template first needs to be discussed to prepare exact logic which will be used on collecting base data and implementing exact triggers logic to not produce some false alarms or produce them only in some exact conditions.

Current version of the template which I'm talking about is on https://github.com/kloczek/zabbix-te...ter/MIB/IF-MIB
Devel version is on https://github.com/kloczek/zabbix-te...vel/MIB/IF-MIB

If you want to continue this discussion please show me first result of two commands wjhich are listed on https://github.com/kloczek/zabbix-te...SNMP%20Devices to see what kinfd of informations is possible to collect on those switches.
Next part of the discussion should be related to exact logic of the monitoring and alarming layer.

I'm not 100% sure but IIRC Cisco switches may as well emit some SNMP traps if some port bandwidth has been saturated.
Collecting those traps could be as well such IF-MIB template. In some cases it may be enough.

kloczek, thank you let me to try and will post the results soon.


To both thank you very much for your quickly response, I may be a little confused.

[grmnrvs]

Hi guys,

A query to both about calculated items, I have an ethernet port of 1Gbps, I have created an item calculated with this formula

last ("SW_SALA-CEO: net.if.in [ifHCInOctets.10122]") + last ("SW_SALA-CEO: net.if.out [ifHCOutOctets.10122]") / 1073741824

... and I think it's not right because it gives me this percentage 6576%

How can I correct it?

I need you to give me the values in percentage from 0 to 100% only.

I am at work now, when I get home I tell you about everything that we have talked about here which I am already resolved after a meeting with my superior, it will not be necessary to do everything I asked for and for which I have returned crazy ...

[Linwood]

Re the ifHCInOctets are you defining the underlying item (not the calculated item, but the two source items) as "Change per second" under the preprocessing rule? Otherwise it simply is the total in the device counter at that moment in time, so the values are quite large.

Also, if it's a 1Gbps capable link, it's almost certainly bi-directional, so if you are going to add it together you need twice 2Gbps as your divisor. Though I still maintain such comparisons are nearly useless, as on a full duplex link saturation will never occur simultaneously in both directions, so (as an example) if you measure 60%, it could be 100% in one direction and 20% in the other (a problem) or 60% in each direction (just fine, no alert needed). Yes, you can do what you describe, but from a network management standpoint it seems rather pointless.

Also, as noted many times, net.if.in/out is a zabbix agent function and not available for snmp agents, which you will need on cisco/hp-switch devices.

[grmnrvs]

Re the ifHCInOctets are you defining the underlying item (not the calculated item, but the two source items) as "Change per second" under the preprocessing rule? Otherwise it simply is the total in the device counter at that moment in time, so the values are quite large.

Also, if it's a 1Gbps capable link, it's almost certainly bi-directional, so if you are going to add it together you need twice 2Gbps as your divisor. Though I still maintain such comparisons are nearly useless, as on a full duplex link saturation will never occur simultaneously in both directions, so (as an example) if you measure 60%, it could be 100% in one direction and 20% in the other (a problem) or 60% in each direction (just fine, no alert needed). Yes, you can do what you describe, but from a network management standpoint it seems rather pointless.

Also, as noted many times, net.if.in/out is a zabbix agent function and not available for snmp agents, which you will need on cisco/hp-switch devices.

Thanks Linwood, my question is because in the map, the links that link each element or host, in the "labels" option I have put the following:

- In: {SW_SALA-CEO: net.if.in [ifHCInOctets.10101] .last ()}
- Out: {SW_SALA-CEO: net.if.out [ifHCOutOctets.10101] .last ()}
- Speed: {SW_SALA-CEO: net.if.speed [ifHighSpeed.10101] .last ()}

And now I would need to create a calculated item to also be able to add the result obtained (in %) to the map, as shown in the attached image.



The information of how to create the labels I have obtained it from the following video

https://www.youtube.com/watch?v=xOr1w6d_e1Y

[Linwood]

I get the desire, I am just saying that a combined percentage is easy to calculate, but has no meaning in the real world.

It's like looking at a traffic problem on a road -- if one side is stopped and not moving and full of cars, and the other side nearly empty, your road is 50% busy, but if you are on the bad side it sure doesn't seem like it.

Regardless, I think you have the math you need, so you can show it of course. Just think about the question of actionable -- there's an argument to be made that if data is not actionable, you should not be calculating or showing it (actionable does not necessarily mean a trigger, it may be where you go for research for some other trigger). So my non-technical suggestion to you is this: ask how one uses that number? How is it actionable for you?

PS. Sometimes the answer is "because my boss wants to see it". I get that.

[grmnrvs]

Well finally i can create the graph with scale from 0% to 100% of bandwidth usage with two calculated items by separately for example for the interface 24, as you can see on the next pictures


Calculated Item for Inbound Badwidth


Calculated Item for Outbound Badwidth


The Graph





A question. Can i make multiple calculated items for each interfaces no need to write each item separately for each interface? as for example I have seen in Discovery Rules> Item Prototypes where a single item is multiplied between all the interfaces if you need to write one by one thanks to the use of macros.

Is there any way to do this but with calculated items?




This is what the map looks like with percentages


Thank you so much!!!

[grmnrvs]

Well ... I'm sorry for the late response. I share with you that you can do it.

I did not use LLD or prototypes, they simply asked me to monitor some ethernet ports on the switches, but the same formula can be used with LLD or item prototypes without any problem. I've also tried it and it works.

For example, to monitor the interface 25 to which a dedicated 12 Mbps link is connected, this is the formula:

• 100*(last(net.if.in[ifHCInOctets.25])+last(net.if.out[ifHCOutOctets.25]))/12582912

It must be considered that by SNMP each manufacturer (HP or Cisco) do not call in the same way their network interfaces, for example HP calls them in the following way:

• ifHCInOctets.25 (data entering interface 25)
• ifHCOutOctets.25 (data coming out of interface 25)

and for the case of Cisco I think they are called:

• net.if.in [ifHCInOctets.125] (data entering interface 25)
• net.if.in [ifHCOutOctets.125] (data coming out of interface 25)

Finally the last value that you see in the formula (12582912) would be 12 Mbps expressed or converted into bits, (use this online calculator https://bit-calculator.com).

This value can be replaced by the desired one, for example to:

• 12 Mbps = 12582912 bits
• 23 Mbps = 24117248 bits
• 100 Mbps = 104857600 bits
• 1000 Mbps = 1048576000 bits
• etc.

I hope it is useful for someone who has the same doubt.

Take this post closed.
Thank you very much.-