Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Putting together a simple MRTG-like setup to monitor the load on our network switches. I've been told that Cisco switches are set up to be polled every five minutes, but we would like to get more precise readings, maybe once per minute.

Is this something that can be done? Or would we just be storing duplicate data because Cisco only updates it's traffic numbers every five minutes, or because they use a five minute rolling average for their readings?

share|improve this question

You can poll ifInOctets/ifOutOctet/ifHCInOctets/ifHCOutOctets every minute without any update problem. The only problem you can have is big CPU usage on the switch/router if you poll to much OIDs/minute (this highly depend on the device model)

PS: MRTG with default storage engine only store data each 5 minutes, so be sure to store data into rrd files

share|improve this answer
I'd rather thank the both of you for your responses than to choose a winner. you've both been more helpful than I expected. – Jaredk Jan 6 '11 at 15:01

The way the SNMP counters work with MRTG (rrd) is that they are the total traffic sent. They than wrap around at 2^32 and 2^64. Then MRTG takes the measurements and figures out the rate from the difference of the two measurements. So it is not like it is taking a snapshot of the current rate.

So my point is that if you poll for the amount of traffic sent more frequently you are not actually going to get more accuracy but rather a higher resolution in time. You will be able to see what the rate was during a specific minute as opposed to every 5 minutes. So when you poll every 5 minutes you are really getting rate per 5 minutes converted to a rate per second such as megabits per second.

You also might have to adjust the rrd files so they don't do averaging over 5 minutes regardless of how many samples you take.

That being said, you can probably poll every minute from SNMP, just make sure you monitor the CPU.

share|improve this answer
As a general rule, if your Cisco kit hits somewhere between 50% and 60% as "average CPU", you're looking at a bit of a surprise, next time there's a perfect packet storm (as in "watchdog timer triggered, causing platform to reboot"). – Vatine Dec 22 '10 at 11:36
I'd rather thank the both of your for your responses than to choose a winner. you've both been more helpful than I expected. – Jaredk Jan 6 '11 at 14:52

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.