I have a customer using NFv9 in/egress and they have concerns about Dynatrace reporting utilisation as greater than 100%. This is happening because DCRUM is on the WAN side of the network and connections going into the LAN is throttled. We changed our NF configuration setting the active timeout to 1 minute and the bandwidth statement on these WAN routers matches the LAN speed.
They're adamant DCRUM remain on their WAN routers, is there anything we can do to prevent reporting at more than 100%? Even capping reports in DMI tables to 100% would be a workaround for us.
I might be sligthly off the mark here but this reminds me of when we were monitoring FrameRelay and they were over provisioned. The SUM ended up being more than the actual interface.
As I recall it, our Netflow based reports is just retelling what the routers are saying, so if the doc/config in the router is off on the bandwidth, that is what we will report. @Mike Hicks - any comments?
Hypothetically - a way around could be to redefine the links as UDL's where you can set the speed to what you want , but I'm not sure it is possible and currently I don't have a NF based system to test it on.
Thanks for your reply, Ulf. The bandwidth matches what we have in another NetFlow tool so that seems ok.
Yeah we are able to define as UDL and previously we had done this, though experienced the same behaviour. Do you think it would make sense to enter a link as UDL matching the ports capable speed rather than actual?
The Bandwidth command it is not there to limit the
bandwidth and you cannot adjust the actual bandwidth of an interface using this
command. The interface bandwidth command is used to communicate the speed
of the interface to higher level protocols. Most of the time, a routing
protocol needs to know the speed of the interface so it can choose the best
route. Another effect of this command is that TCP will adjust its initial
retransmission parameters based on the bandwidth configured on the interface.
The collector uses the speed specified in the SNMP OID. Do you know what
It depends on what that is set to/reading as in relation to the flow sets assigned to that interface, for example if we have "duplicate" flows caused by logical sub interfaces (which is essentailly waht Ulf mentioned), ie we see teh wrapper and the transported application you can see double traffic. can is see a copy of the trace file?