From: Scott Vermillion (scott_ccie_list@it-ag.com)
Date: Wed Nov 14 2007 - 22:20:35 ART
Hi Alex,
OK, credit to the IE Brians here because they just covered this today in the
CoD I'm doing. So they gave a great explanation and a great example.
Basically, what they said was that you are dealing with a delta situation
when the number only increases and never decreases. So, for example, bytes
in or number of collisions is only going to increment up. So it's a
question of what the delta is from one reference point in time to another.
Then consider something like CPU utilization. If you only looked at delta
between say minute one and minute two, what if it was at 10% exactly at
minute one and 10% again at minute two but had spiked to 100% for 30 seconds
somewhere in between? So you'd want to know what was the absolute max
number in this situation where the quantity of interest can both increment
and decrement.
So in the below task, it would indeed be a delta type of a situation. What
you're measuring is the delta from the start of one minute to the end and
then over and over and over again. If you tried to evaluate this sort of
thing as an absolute, you'd end up with an average, wouldn't you? It would
be some absolute number of bytes divided by some absolute number of minutes
and what's the good in that (other than to calculate your average,
obviously) if what you're targeting is the value of bytes within one single
of those minutes? You want to know the delta from the beginning of the
minute to the end, and if that is < some number or > than some number,
generate an alarm and send an event.
Brians - hope you don't mind my paraphrasing your CoD here but I felt like
your explanation was one that was really going to stick in my mind (which it
apparently is so far) and that it was worth sharing. Write to me offline or
here on the list if this falls in the "not cool" category (and apologies in
advance if it does).
Regards all,
Scott
-----Original Message-----
From: nobody@groupstudy.com [mailto:nobody@groupstudy.com] On Behalf Of Alex
Steer
Sent: Wednesday, November 14, 2007 3:34 PM
To: ccielab@groupstudy.com
Subject: simple rmon absolute/delta question
Hi,
I recently had the question below and got it wrong because I configured
an absolute instead of a delta reading. I'm abit worried I have
misunderstood the meaning of delta and absolute. Can some one clear
this up for me please?
Many thanks
Alex
(word for word question below)
The Network administrator has requested that R1 log an event when the
interface input octets (ifEntry.10.1) value reaches 45000 per minute and
when the value falls back below 35000 per minute.
The sampling interval should be every 60 seconds
When the 45000 threshold is breached an events should be generated that
reads "Rising above 45000 for ifInOctets"
When the value falls back to 35000 an event should be generated that
reads "Rising above 45000 for ifInOctets"
The server to log these events to is 129.X.58.100
Ensure these messages are time stamped with the system's current time
including the millisecond
This archive was generated by hypermail 2.1.4 : Sat Dec 01 2007 - 06:37:29 ART