monitor 1Gb network adapter taffic get over 1Gb network traffic data

[yanxiaolu]

as I know，the zabbix_agent on Windows use pdh api to get system performance infomation,but why I got over 1Gb traffic data on 1Gb network adapter when I monitored Windows Server 2008 ？

[Pada]

This simply looks like a sampling issue. If you're going to set your "Update Frequency" to anything less than 60 seconds, you're more likely to see sampling issues than if you'll be using 60 seconds or longer intervals.

bps = (Total bits @ end - Total bits @ start) / (time @ end - time @ start)

So if you were to take the measurement at 00:00.0 and the end one at 00:10.5 and not exactly at 00:10.0, and Zabbix cannot do durations more accurate than a second, then you'll be 5% higher than 1Gbps already.

eg. If Zabbix were to take the measurements at EXACTLY 00:00.0 & 00:10.0:
(10Gbp - 0Gb)/(10 - 0) = 1Gbps

And if it is 0.5s too fast / too slow:
(10.5Gbp - 0Gb)/10 = 1.05Gbps

So my solution to your problem is simply to increase your Update interval from 10s to 60 seconds.
In our Zabbix setup, we don't really have items being monitored faster than 30s intervals, except for the Packet Loss & Ping values, where we want to pick up the smallest possible network errors.

We also had sampling issues in some of our systems where our update interval was 60 seconds, because we had a situation where Zabbix would be slightly out of sync with the stats process that updates its stats to a file every 60 seconds, which caused the values to fluctuate between 2x the normal value at 01:00, and then down to 0 @ 02:00 and then back to 2x the real value at 03:00.
We solved this by modifying our stats process to use Zabbix sender, which is simply a direct method of writing the stats into Zabbix. This way there is no way for Zabbix and our stats process to get out of sync and cause sampling issues.

[LenR]

Is the windows system a VM? I'm suspicious that virtual nic's can exceed their rated speed if the traffic is between VM's in the same hypervisor, I think I've seen it, but can't reproduce it....

[yanxiaolu]

Is the windows system a VM? I'm suspicious that virtual nic's can exceed their rated speed if the traffic is between VM's in the same hypervisor, I think I've seen it, but can't reproduce it....

No,that's real server

[yanxiaolu]

This simply looks like a sampling issue. If you're going to set your "Update Frequency" to anything less than 60 seconds, you're more likely to see sampling issues than if you'll be using 60 seconds or longer intervals.

bps = (Total bits @ end - Total bits @ start) / (time @ end - time @ start)

So if you were to take the measurement at 00:00.0 and the end one at 00:10.5 and not exactly at 00:10.0, and Zabbix cannot do durations more accurate than a second, then you'll be 5% higher than 1Gbps already.

eg. If Zabbix were to take the measurements at EXACTLY 00:00.0 & 00:10.0:
(10Gbp - 0Gb)/(10 - 0) = 1Gbps

And if it is 0.5s too fast / too slow:
(10.5Gbp - 0Gb)/10 = 1.05Gbps

So my solution to your problem is simply to increase your Update interval from 10s to 60 seconds.
In our Zabbix setup, we don't really have items being monitored faster than 30s intervals, except for the Packet Loss & Ping values, where we want to pick up the smallest possible network errors.

We also had sampling issues in some of our systems where our update interval was 60 seconds, because we had a situation where Zabbix would be slightly out of sync with the stats process that updates its stats to a file every 60 seconds, which caused the values to fluctuate between 2x the normal value at 01:00, and then down to 0 @ 02:00 and then back to 2x the real value at 03:00.
We solved this by modifying our stats process to use Zabbix sender, which is simply a direct method of writing the stats into Zabbix. This way there is no way for Zabbix and our stats process to get out of sync and cause sampling issues.

thanks for your respones!
but I still don't understand your example and I can't to calculator the result as you said,if the issues is frequency too fast maybe meansurement at sometime on 0.5s,but why your example is 10.5Gbp (10.5Gbp - 0Gb)/10 = 1.05Gbps)?

[Pada]

thanks for your respones!
but I still don't understand your example and I can't to calculator the result as you said,if the issues is frequency too fast maybe meansurement at sometime on 0.5s,but why your example is 10.5Gbp (10.5Gbp - 0Gb)/10 = 1.05Gbps)?

If you were to do exactly 1Gbps, then in 10.5 seconds, you would've accumulated 10.5Gb.
Due to Zabbix only being accurate to the second, it won't divide 10.5Gb with 10.5s, instead it divides it by 10.

One thing that is still confusing for me is how it can manage to jump to 3.75Gbps, because if its simply a rounding issue like I mentioned, then you shouldn't be off by more than like 20-30%.

What happens if you zoom in on that section when it spiked to 3Gbps and you go to the Values page? Can you see from the timestamps that it couldn't maintain a steady 10s interval?