Denika Link usage graph vs Scrutinizer

[shadowman724]

Hi,
I have both Scrutinizer and Denika running on my production network for more than one year. Today, I noticed an abnormal behaviour. For the same interface, I see differences in usage percentage between Denika and Scrutinizer.
In Denika, I see that the interface is used at 25kbps inbound. In Scrutinizer, I only see 1kbps inbound.
Did anybody experience data inconsistency with any of these software products?

[BenjaminM]

Hi shadowman724,

I need to ask a few questions regarding this issue to gain more knowledge to troubleshoot this issue.

Is there any encrypted traffic going over this interface in Scrutinizer?

Are you comparing the same time frames in both Denika and Scrutinizer? Keep in mind that SNMP in Denika uses 5 minute averages in the graphs. You can control the time intervals you see in Scrutinizer.

What version of Scrutinizer are you using?

Thanks,
Ben

[shadowman724]

Hi Benjamin,
Here are the answers to the questions:
- There is no traffic being encrypted on the interface,
- yes, I used the same timeframe on both software products. Now on Scrutinizer, we do not see the interface in the status tab; I guess Scrutinizer sees no flows coming from the interface. However, with Denika, we see traffic. Please check the screenshots.
- I'm using Scrutinizer version v7

[dalet0]

Hi shadowman724

Can you please try looking at a one hour time frame in both Denika and Scrutinizer. The reason for that is we want to be using 1 minute MySQL DB tables in Scrutinizer to get better figures. An hour report in Scrutinizer uses "1 minute" interval DB tables. Or if you prefer to use a larger time frame, please make sure to switch to "1m" tables.

The following page has details on this:
http://www.plixer.com/blog/scrutinizer/ ... reporting/

Thanks
D

[shadowman724]

Hi,
Please find attached screen captures of both Scrutinizer and Denika, for a 1h timeframe. I see a huge difference between both outputs.

[scottr]

Hi,

Is there other traffic taking place on this interface besides the single host to host traffic being reported?

Scott

[shadowman724]

Hi Scott,
No there is no other traffic on it. Besides, to make sure, we refer to Scrutinizer to detect which traffic goes in and out of the interface.
So am I correct to say that Denika has "issues" with frame relay subinterfaces, based on the comparison between Denika and Scrutinizer?

[scottr]

Based on what I saw yesterday. The interface is only seeing outbound traffic between those 2 hosts.
I am not aware of any issue that Denika has in reporting on frame relay subinterfaces. But it was surely showing inbound traffic for the same time.

Scott

[shadowman724]

Hi Scott,
I shutdown the frame-relay subinterface and the PPP interface this morning. Denika correctly reports that there is no more traffic on the PPP interface:


interface Serial0/0/2
description --- LS ---
ip address xxxxxxxxx
ip flow ingress
ip flow egress
encapsulation ppp
shutdown
no cdp enable
!
interface Serial0/0/0.21 point-to-point
description ********** Connexion - backup **********
ip address xxxxxxxxxxxx
ip flow ingress
ip flow egress
shutdown
no cdp enable
frame-relay interface-dlci 21
end

Jan 11 09:31:49.604 CET: %LINK-5-CHANGED: Interface Serial0/0/2, changed state to administratively down
Jan 11 09:31:49.608 CET: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0/0/2, changed state to down


However, it still reports traffic on the frame-relay subinterface! Please check the screenshots. Do you have an idea what the issue could be?

[scottr]

Hello,

Does Scrutinizer show traffic or no traffic?

If you do a show command on the router, does it show traffic?

Scott

[shadowman724]

Hi,
- Scrutinizer shows the interfaces as greyed. Besides, they are not displayed on the main Status tab.
- can you specify which "show" command to issue?

[scottr]

I believe that the command is:

show interface [interface name] stats

[shadowman724]

on the PPP interface:

TNRTEXCS01A1#sh int ser0/0/2 stat
Serial0/0/2
Switching path Pkts In Chars In Pkts Out Chars Out
Processor 0 0 2732 43712
Route cache 5404 86464 2672 42752
Total 5404 86464 5404 86464

on the Frame relay subinterface, the command is not allowed.

any idea?