MRTG values mismatch snmwalk

Question

I have MRTG values show as 15Kbps, but when I check through snmwalk I got about 2G.

How can I fix this issue to let MRTG represent 2G on Graph as reported by SNMP?

Answer 1

Not knowing EXACTLY what you are querying, it is LIKELY that the snmpwalk returns absolute values, whereas MRTG returns "per second" values (ie. divided by time), or the first derivative with respect to time. Can you confirm which you calculated?

Answer 2

With a rate of 2G, you are likely hitting counter wraparound, when your 32bit SNMP counters are growing so fast that they overflow before you have time to read them.

You should make sure to do the following:

• Use 64bit counters, not 32bit. This means using SNMPv2 and the HC counters; usually, adding the ":::::2" suffix to the Target works for this. E.G. 3:public@router1:::::2
• Poll more frequently; maybe every 60s rather than every 5min
• Ensure your MaxBytes setting is correct, so that high values are not dropped

From the MRTG manual:

SNMPv2c

If you have a fast router you might want to try to poll the ifHC* counters. This feature gets activated by switching to SNMPv2c. Unfortunately not all devices support SNMPv2c yet. If it works, this will prevent your counters from wraping within the 5 minute polling interval, since we now use 64 bit instead of the normal 32 bit.

Example:

 Target[myrouter]: 2:public@router1:::::2

View the MRTG documentation for more information.