## MRTG averages over a time period - mean vs sampling

### MRTG averages over a time period - mean vs sampling

I am new to MRTG, and I am trying to compare its results to some
packet traces recorded by Netmetrix.   The MRTG graphs sent to me show
"average" and "peak" utilization over a 1-hour period.   There are 14
data points - it looks like 1 at the beginning of the hour, 1 at the
end, and 12 in between, so presumably these stats are recorded every 5
minutes.

My question is whether the stats are based on raw data collected
during a 5-minute period or whether MRTG is just recording 1 packet
every 5 minutes.  I am assuming that it collects every packet over the
interval, determines the mean and max, and then starts over with a new
5-minute interval.  Is this correct?  (Netmetrix, when used in
"sampling" mode, actually only records every Nth packet, where N is
configurable and dependent upon the link speed.  That's why we use it
in packet mode, where it just records every packet it sees.)

Thanks.

### MRTG averages over a time period - mean vs sampling

Quote:> I am new to MRTG, and I am trying to compare its results to some
> packet traces recorded by Netmetrix.   The MRTG graphs sent to me show
> "average" and "peak" utilization over a 1-hour period.   There are 14
> data points - it looks like 1 at the beginning of the hour, 1 at the
> end, and 12 in between, so presumably these stats are recorded every 5
> minutes.

> My question is whether the stats are based on raw data collected
> during a 5-minute period or whether MRTG is just recording 1 packet
> every 5 minutes.  I am assuming that it collects every packet over the
> interval, determines the mean and max, and then starts over with a new
> 5-minute interval.  Is this correct?  (Netmetrix, when used in
> "sampling" mode, actually only records every Nth packet, where N is
> configurable and dependent upon the link speed.  That's why we use it
> in packet mode, where it just records every packet it sees.)

> Thanks.

MRTG uses by default the snmp counters in the device you are pulling for
snmp data.

Or should I explain it like this: The snmp counters are a acumulated value.
MRTG is calculating the traffic as the difference betwen two sampled values
during a time period.

The snmp counters can be a 32bit or 64 bit value (depending on manufacturer
and snmp version).

Kind regards
Mats

Everything works on mrtg great, but we were doing some throughput
testing and following the path of the test through 8 interfaces, all
monitored by MRTG on several switches

What I found, which I had suspected before was that the values that
plot the blue-Outbound traffic are not calculated correctly. They
appear to be averaged over 5-6 samples.

In our test I sustained a 50 megabit load end-to-end.

On the IN-green chart of each port involved the values were a straight
line, showing a sustain 50Mb transfer for one hour.

for example:
00:00  50mb
05:00  50mb
15:00  50mb
20:00  50mb
25:00  50mb
30:00  50mb
35:00  50mb
40:00  50mb
45:00  50mb
50:00  50mb
55:00  50mb

THE EXACT SAME TRANSFER on blue-outbound ports showed

for example:
00:00  8.mb
05:00  17mb
15:00  26mb
20:00  38mb
25:00  49mb
30:00  50mb
35:00  50mb
40:00  50mb
45:00  50mb
50:00  50mb
55:00  50mb

This "ramp up" is impossible, because the next hop showed in green a
50 Mb transfer during "ramp up".  Clearly there is a calculation error
occuring in the outbound levels. It takes at least 5 samples for the
outbound-blue graph to show actual levels.

Does anyone know of a bug or fix?
I'm checking our MRTG now. It was setup by a consultant--I actually
have no clue of the rev were running (on Solaris).