Utilization Out above 100 %

[Praveen Venkatesan]

All ,

 In one our interface the utilization out is above 100 % ,in what cases it might happen. The Interface is picked High Speed interface VC .Did anyone encountered these type of issues ?

[Jeffrey Pinard]

It's 1 of 2 things:

1. the reported ifHighSpeed by SNMP agent is wrong.
2. the device is reporting bad value for IfHCIn/OutOctets.

We've seen both happen in various devices.

You're best bet is to run dcdebug on DA and do detailed poll logging to see what the SNMP agent is returning for values during the time of the values > 100%.  If you have not used dcdebug before, then reach out to support for help.

[Praveen Venkatesan]

It is happening for cisco virtual interfaces mostly , the physical interface has 100 Mbps speed in/out .. however the sub virtual has 100 kbps in/out.

[Jeffrey Pinard]

I would suggest checking with the person responsible for configuring the device.  Check what the real speeds of the sub-interfaces are.

If they don't align to what SNMP agent is reporting, check with the device vendor to see if there is a problem with agent.

In the mean time, you can override the speed in/out via the Polled Metric Families Interface MF UI or DA rest.

[Praveen Venkatesan]

But the data in ehealth is working fine with actual % .  The physical interface which speed is overridden as 1000 Mbps is working fine and its virtual interface which is overridden as 1000 kbps is showing 1000 % 

But in this case how the 32 bit and 64 bit VC  is distributed to interface which differs in speed.

[Jeffrey Pinard]

So Portal and eHealth are reporting the same speedin/out for all the same sub-interfaces?

You can use dcdebug detailed poll logging to see what DC is polling the sub-interface items for data.  Are we getting similar ifHCIn/OutOctets between the 2 products?  The diff would be time of poll, as eHealth I believe does all polling at start of poll cycle, and DC spans the polling across the poll cycle.

Note: HighSpeedInterface VC allows for polling low speed (32bit) vs high speed (64bit) interfaces on the same device.  It comes down the ifHighSpeed/ifSpeed (or override) value per interface that determines if we use the 64bit vs 32bit OIDs.

[Praveen Venkatesan]

Feb 15 17:56:20.173:     RawIfSpeed: 1000000000 (Long)
Feb 15 17:56:20.173:     CalculatedSpeedIn: 1000000.0 (Double)
Feb 15 17:56:20.173:     CalculatedSpeedOut: 1000000.0 (Double)
Feb 15 17:56:20.173:     maxOctets20Mbps: 786432000 (Long)
Feb 15 17:56:20.173:     CalculatedIfInOctets: 4223496 (Long)
Feb 15 17:56:20.173:     CalculatedIfOutOctets: 374891068 (Long)
Feb 15 17:56:20.173:     CalculatedIfHCInOctets: 4223496 (BigInteger)
Feb 15 17:56:20.173:     CalculatedIfHCOutOctets: 374891068 (BigInteger)
Feb 15 17:56:20.173:     CalculatedDuplexStatus: 3 (Integer)
Feb 15 17:56:20.173:     UtilizationMaxPercent: 2000 (Integer)

DCMResponseVariable [name={http://im.ca.com/normalizer}NormalizedPortInfo.UtilizationOut, value=999.7095146666666 (Double) ]

I could see utilization out is close to 1000

[Jeffrey Pinard]

So from that, it seems the device is reporting the Raw speed as 1,000,000,000 (1Gbps).

But the calculated speed in/out is:  1,000,000.0 (1Mbps).

In newer DC logging we include the SpeedInOverride/SpeedOutOverride values used.

So it appears the Octets are being produced at a 1Gbps level, but you are treating it as a 1Mbps level, so yes, it's gonna report > 100% utilization.   Lowering the speed of the sub-interface via speed override doesn't cause the octets to run at as slower speed.

Utilization Out is ((374,891,068 * 8bits) / (speed * poll in secs)) * 100 = ((374891068 * 8) / (1000000 * 300)) * 100 = 999%.