replacing/deleting outliers

[Anon Anon]

Anyone have a method for replacing or deleting outliers? For example, tracking tens of interfaces over a month. One interface reports utilization of 15 billion %. Makes the chart unusable, plus there's no sense in reporting such a value. I'd like to delete the value or replace with an appropriate value.

[Justin_Kulikowski]

I can't help you with deleting the existing data, but this will most likely help going forward:

 

On each Data Collector in the directory $IMROOT/apache-karaf-2.3.0/etc, create a new file named "com.ca.im.dm.snmp.collector.SnmpCollector.cfg", and insert this single line:

 

showGapsOnCounterRollover=true

 

The parameter is picked up automatically, so no restart is required.

 

 

By default the Data Collector tries to be smart about calculating counter roll-overs.  This is a great idea and good intentions on CA's part -- however, SNMP agents have the potential to be buggy and we came across many vendors/platforms that like to roll-over at random times.  The Data Collectors happily calculate the amount of data that would've been needed to account for a legitmate roll-over, and thus you're left with 15,000,000,000%.

 

We've been in really good shape since applying this parameter, as we would rather see a gap in data than bogus data.

[Anon Anon]

Thanks. I'll give it a shot.

[Josh Bovee]

Thanks Justin.  That's a nice little hack.  It would be really cool if this file were to be included with the default install but have that line commented out.  That would make it a lot easier for folks to change the setting if desired.

[Anon Anon]

The answer provided helps to keep outliers from getting created moving forward but there is still the question of how to get remove or mitigate an outlier that has already been processed.  Is there a method to mitigate existing outliers?