[ZBX-14322] Abnormal flow peak (peak) Created: 2018 May 04  Updated: 2018 May 15  Resolved: 2018 May 15

Status: Closed
Project: ZABBIX BUGS AND ISSUES
Component/s: Frontend (F)
Affects Version/s: 3.4.10rc1
Fix Version/s: None

Type: Incident report Priority: Major
Reporter: 李阳 Assignee: Unassigned
Resolution: Duplicate Votes: 0
Labels: Abnormal, traffic
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified
Environment:

centos7


Attachments: PNG File ggggggggggggggggggg.png     Text File image-2018-05-07-20-05-15-421.png     PNG File llt.png     PNG File llt1.png     PNG File screenshot-1.png     PNG File zabbix_conf.png     PNG File zabbix_conf1.png     PNG File zabbix_conf2.png     PNG File zabbix_conf3.png     PNG File zdfx.png     PNG File zdfx.png     PNG File zdfx1.png     PNG File zdfx2.png    
Issue Links:
Duplicate
duplicates ZBX-14321 异常流量峰值(尖峰) Closed
duplicates ZBX-14318 SNMP Interface Speeds exceed physical... Closed

 Description   

Snmpv2 protocol acquisition switch flow, found that the flow chart is abnormal peak, peak value is greater than the network card rate, don't know why have this data, trouble experienced eldest brother, to give some directions. See attachment for specific configuration and flow chart.



 Comments   
Comment by Alexey Pustovalov [ 2018 May 04 ]

Are you sure that you need multiply? I suppose you need to use 0.125 multiplier.

Comment by Glebs Ivanovskis (Inactive) [ 2018 May 05 ]

Multiplier 8 is correct if octets need to be converted into bits.

I think that the issue may be caused by overflow of 32-bit counters. 64-bit counters should be used.

Comment by Glebs Ivanovskis (Inactive) [ 2018 May 05 ]

Is the host monitored by proxy or directly by server?

Comment by 李阳 [ 2018 May 07 ]

Hello, I am using the oid of counter64, which is collected by the server directly on the switch and there is no agent in the middle.

Comment by Glebs Ivanovskis (Inactive) [ 2018 May 07 ]

Hm, is it a coincidence that all abnormal spikes in the graph are in the beginning of the hour?

Can you show Zabbix server performance graphs for the same period of time?

Is bulk mode enabled for that interface?

Comment by Glebs Ivanovskis (Inactive) [ 2018 May 07 ]

Can you create an item with identical OID, but without preprocessing? We would like to see raw values gathered by Zabbix at the time of anomalous spikes.

Comment by 李阳 [ 2018 May 07 ]


Hello, I use the discovery automatic discovery port, automatically generate item, automatically add graphs, attachments are my screenshots.
I have observed that every abnormal flow is done in one minute. The abnormal traffic is a multiple of the previous normal data. I guess it will be zabbixserver collecting data while the network jitter does not get the data. When you get the data again, it has been accumulating in a few minutes and after the ZABBIX front value is reduced. The data can be shown to be so unusual.

Comment by 李阳 [ 2018 May 07 ]



If you do not do any processing, there is a value of nearly 300P. It is too big to see any Change. I choose Change per second.

Comment by Glebs Ivanovskis (Inactive) [ 2018 May 07 ]

Please show values, not the graph.

Comment by 李阳 [ 2018 May 07 ]

Latest data can only display a currently acquired value. How can we display all data values?

Comment by Glebs Ivanovskis (Inactive) [ 2018 May 07 ]

Like so:

Links to value history/simple graph

The last column in the latest value list offers:

  • History link (for all textual items) - leading to listings (Values/500 latest values) displaying the history of previous item values.
  • Graph link (for all numeric items) - leading to a simple graph. However, once the graph is displayed, a dropdown on the upper right offers a possibility to switch to Values/500 latest values as well.
Comment by Glebs Ivanovskis (Inactive) [ 2018 May 15 ]

Closing as Duplicate of ZBX-14318 which looks very similar. Dear liyang, if you have additional information to provide, please do it in ZBX-14318.

Generated at Tue Apr 01 19:03:18 EEST 2025 using Jira 9.12.4#9120004-sha1:625303b708afdb767e17cb2838290c41888e9ff0.