1

I need to track traffic in and out on our servers. I have a nagios plugin that monitors either 32 or 64 bit counters for ifXXOctets.

$in_octet_table = '1.3.6.1.2.1.2.2.1.10.'; $in_octet_table_64 = '1.3.6.1.2.1.31.1.1.1.6.';

$out_octet_table = '1.3.6.1.2.1.2.2.1.16.'; $out_octet_table_64 = '1.3.6.1.2.1.31.1.1.1.10.';

I threw it at one of our web servers, using the 64 bit oids, and I was surprised to discover that the server reports many more inbound octets than outbound. (I made sure I was querying the proper interface.)

This seems counter intuitive for a web server.

Our webservers are Centos 7 cloud servers in Rackspace Cloud.

Any ideas?

Ed G

6
  • 1
    Does your webserver communicate with an appserver elsewhere? Maybe an app on it connects to webservices elsewhere? If it's Apache you can use mod_logio to enable %I %O and %S logging options for request and response sizes. – DerfK Mar 7 '17 at 22:51
  • Byte counters tend to wrap, although I wouldn't expect an 64 bit counter to wrap very often. Try gathering values over a period of time and see which value is increasing. – BillThor Mar 7 '17 at 23:28
  • What had got the SNMP counters? Real network card on physical server, virtual interface on host or guess machine or interface on switch? – Mikhail Khirgiy Mar 8 '17 at 4:44
  • 1
    Thanks, folks. I think that they reason that in is higher than out is a combination of database and redis traffic. – Ed Greenberg Mar 8 '17 at 13:08
  • Out on the server is in on the switch port, are you checking at the server or the switch? – ms4720 May 2 '17 at 8:36
1

This is not uncommon. Your server might be accepting large uploads from clients, or making a request to a service on a different machine that then receives a large set of data. You need to understand your application model to know if this is unusual or not.

If you want to figure this out in more detail, try grabbing the counters from your switch as well as the server and see if the deltas move at the same rate (the absolute values will be different as they started counting at different times).

You can use things like Netflow if you want a more in-depth view of exactly what you are talking to, and which protocols it is using. ntop-ng is a neat tool for visualising flows, and supports more than just standard netflow.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.