Today the NFA datasource allows the aggregation of netflow interfaces, it would be helpful to have the same capability for snmp interface views.
This is a feature we need and have been asking for. The ability to aggregate circuits together would give us the ability to take a primary circuit and a backup circuit and aggregate them to look like one circuit. One use case is as you have laid out above where you add the circuits together to get a total usage. This works for a site where multiple links make up the production interfaces, or in our use case bundled circuits.
Another very valuable use case would be Failover, in this case we would need the ability to define a failover aggregate and measure that circuit as if it where only one circuit. For example if a site had 2 10Mbs Circuits (keeps math easy) and we are doing a failure analysis we would want to see how the traffic crossing the aggregate would look at 10Mbs, if one failed. So we would have one running at 50% and second running at 35% then the failover aggregate would be at 85% of 10Mbs. This could be a separate type of Aggregate where we defined the bandwidth it should report at or that could just be a feature or option on the aggregate to Add circuits, Set bandwidth to 50% or set a Manual bandwidth value for the aggregate.
Jason check your math, both ways of calculating should match. I think one issue you have is the one circuit is 100 and the other 2 are 50. However on the second line you have 50% in the Current and 50Mbs (100%) in the Desired Behavior calculation. Whichever way you calculate it they should come out the same.
Here is an attempt at a 95th percentile calculation for the "aggregated circuit". Does this look "correct"?
This is actually a hot topic folks so I wanted to chime in. We understand the need for this use case and we want to provide more aggregation options. The problem comes in on the Math. Seems there are a few different ways that data consumers want to put these numbers together.
I'd love your help in understand which resonate with your needs. Lets keep the conversation moving in this thread and I'm going to set this to "under-review" so we can at least get the "what" right.
Let's start simple and look at Utilization as an average for a group (or an 'aggregate circuit') as well as Utilization as a Trend representation for that group/aggregate. Don't worry about as-polled vs hourly data - at least for now anyway. We can figure that one out once we get the basics. We'll also discuss 'percentiles' once we get this basic example nailed.
We'll assume there are 3 interfaces dedicated as that 'aggregate circuit'. 2 are primary at physical speed of 100 Mbps and 1 is a backup or fail-over with physical speed of 50 Mbps. The aggregated circuit itself will have a CIR of 200 Mbps. I know this isn't the most realistic example but it makes the math much easer. We're just trying to get the math or algorithms right.
To continue our simple example we'll say we polled each of those 3 interfaces at 1 second intervals (we obviously don't do 1 second polling but it would be nice and it again makes the math easy) for 4 seconds. Now ...
If I wanted to report on Average Utilization for that 'aggregate circuit' for those 4 seconds, here are two scenarios:
Scenario 1: How CAPC does this today
Scenario 2: Aggregate Circuit desired behavior
Is the math in scenario 2 "right"? for your use cases? If not, how does it differ?
If I wanted to report on the Utilization Trend for that aggregate circuit for those 4 seconds, here are two more scenarios:
And here's an overall comparison to see how they differ.
Would LOVE your feedback as I'm sure there is more than 1 way to do this but I bet 90% will have VERY similar needs. Keep all communications in this thread for easier tracking!
This is a request from few customers. It would be nice to have this.
We have for our customer (MSP) the same requirement.
Basically we need to aggregate traffic (bandwith util in % and Bits/Bytes) for single site of external customer - there are 2 to n interfaces used.
Here's an example:
Two interfaces are used for internet traffic to a particular site. Would like to report on utilization of the aggregate internet traffic as opposed to individual links.
Could anyone provide a little more color, maybe an example or two of the type of view you're interested in and actual vs expected behavior? Thanks.
I must say that the fact that we don't have that in CAPC is very frustrating.