Peaks on network interface activities

[NStorm]

Hello.

I'm running Zabbix Server 3.4.4 on CentOS 7. Agents are running on CentOS 6 hosts. Network interfaces was discovered and graphs added by 'Network interface discovery' from Linux template.
I've only edited template a bit to add a calculated parameter of total in+out traffic which ls 'last(net.if.in) + last(net.if.out)' actually, shouldn't matter here.
Sometimes I'm getting unrealistic spikes on graph like this:

Which on a zoom looks like this:


Other than those spikes rest is graphed normal:


Checking the database for actual item values during those peaks shows the values of net.if.in/net.if.out are actually quite high sometimes.

Why does this happens? Some sort of overflow?

[nelsonab]

Just to make sure I'm understanding correctly, you're seeing the spike on a calculated item, which is dependent upon the total in and outbound traffic?

If that is the case, my first speculation is that you might be seeing an artifact of number rollover. Integer values can grow only to a certain point before they overflow and either become negative or start again at 0.

How are the underlying items configured? I'm assuming you're storing the data as change over time, using that pre-processor? What is the time interval for the calculation and the interval for the interfaces?

You'll also want to get the values for the interfaces for a few intervals before the spike, this way you can see what actual values were used in the calculation.

[NStorm]

No, the spikes are coming from built-in net.if.in (green on a graph) or net.if.out (blue on a graph). They are just standard LLD items from fresh Zabbix install, I just renamed them in template.

Calculated item (gray on graph) are actually working as expected. Yes, it's also on spike but that is because underlying net.if.in (green).