[ixpmanager] Discrepancies between sflow hosts

[Ian Chilton]

Hi,

On 19 Feb 2021, at 10:59, Nick Hilliard wrote:
> All switch sflow implementations have sampler rate limiters

Yeah I thought that might be the case - that’s why I removed it after 
a short while.


> Hard to tell what's going on here.  A good starting point would be to 
> compare the
> mrtg Infrastructure Aggregate Graphs against the sflow VLAN Graphs.

So right now we’re doing 494G on MRTG: 
https://www.lonap.net/mrtg/lonap-total.html

Old sflow shows 311G of ipv4 and 19G of ipv6: https://ibb.co/6FwjYLj

New sflow shows 224G of ipv4 and 13G of ipv6: https://ibb.co/FmhthdQ

(Pre the first gap is data rsync’d from the old box - it took a while, 
hence the big gap, and after that is generated on the new box - with 
another gap when I switched from direct sflow to sflowtool fanout from 
the old box).

Though our grafana dashboard which takes the old sflow data -> graphite 
shows 451G total, of which 26G is v6 on our main peering vlan - so 
that’s closer to MRTG, though not sure why it’s different to the RRD 
graphs in IPXM?!

Am on holiday today so haven’t had chance to look in to it yet, but I 
guess the first step is to establish, is the problem the difference 
coming from the incoming sflow data or the resulting RRD data…. Does 
such a script exist that will allow me to total/visualise the incoming 
sflow data at all, to compare between the 2 boxes? - what about any kind 
of debugging on what sflow-to-rrd-handler is doing?

As an aside, what sflow settings do you use on your Arista boxes? - we 
have:

sflow sample 16384
sflow destination 192.168.x.x
sflow source-interface Management1
sflow run

Nothing to do with this and the difference in graphs/values with the 
same set of data, but more generally, I wonder if we need to review that 
sample size?


> Are you running update-l2database.pl for your new installation?

Yep! - that’s running 1/2hrly on the new sflow box now.

Thanks,

Ian