Home / server / Questions / 214543
In Process
Jaredk
Asked: 2010-12-21 11:18:39 +0800 CST

Is it feasible to poll traffic readings from Cisco switches more often than every five minutes?

  • 772

Putting together a simple MRTG-like setup to monitor the load on our network switches. I've been told that Cisco switches are set up to be polled every five minutes, but we would like to get more precise readings, maybe once per minute.

Is this something that can be done? Or would we just be storing duplicate data because Cisco only updates it's traffic numbers every five minutes, or because they use a five minute rolling average for their readings?

networking monitoring cisco traffic mrtg

2 Answers

  1. You can poll ifInOctets/ifOutOctet/ifHCInOctets/ifHCOutOctets every minute without any update problem. The only problem you can have is big CPU usage on the switch/router if you poll to much OIDs/minute (this highly depend on the device model)

    PS: MRTG with default storage engine only store data each 5 minutes, so be sure to store data into rrd files

    • 3

  2. The way the SNMP counters work with MRTG (rrd) is that they are the total traffic sent. They than wrap around at 2^32 and 2^64. Then MRTG takes the measurements and figures out the rate from the difference of the two measurements. So it is not like it is taking a snapshot of the current rate.

    So my point is that if you poll for the amount of traffic sent more frequently you are not actually going to get more accuracy but rather a higher resolution in time. You will be able to see what the rate was during a specific minute as opposed to every 5 minutes. So when you poll every 5 minutes you are really getting rate per 5 minutes converted to a rate per second such as megabits per second.

    You also might have to adjust the rrd files so they don't do averaging over 5 minutes regardless of how many samples you take.

    That being said, you can probably poll every minute from SNMP, just make sure you monitor the CPU.

    • 2