[ixpmanager] Discrepancies between sflow hosts

[Nick Hilliard (INEX)]

Ian Chilton wrote on 19/02/2021 14:13:
> So right now we’re doing 494G on MRTG: 
> https://www.lonap.net/mrtg/lonap-total.html
> 
> Old sflow shows 311G of ipv4 and 19G of ipv6: https://ibb.co/6FwjYLj
> 
> New sflow shows 224G of ipv4 and 13G of ipv6: https://ibb.co/FmhthdQ

more importantly, the old sflow matches the shape of the lonap-total 
graph.  The new sflow doesn't, and that's a bad sign.

> Am on holiday today so haven’t had chance to look in to it yet, but I 
> guess the first step is to establish, is the problem the difference 
> coming from the incoming sflow data or the resulting RRD data…. Does 
> such a script exist that will allow me to total/visualise the incoming 
> sflow data at all, to compare between the 2 boxes?

There is an sflow visualiser available on the inmon web site somewhere.

> - what about any kind 
> of debugging on what sflow-to-rrd-handler is doing?

# sflow-to-rrd-handler --debug
# sflow-to-rrd-handler --insanedebug

Most likely what's happening here is that there are MAC addresses 
appearing in the sflowtool output that sflow-to-rrd-handler doesn't know 
about.  This would be the usual reason for losing traffic on the graphs.

> As an aside, what sflow settings do you use on your Arista boxes? - we 
> have:
> 
> sflow sample 16384
> sflow destination 192.168.x.x
> sflow source-interface Management1
> sflow run

All our configs are here:

> https://github.com/inex/ixp-manager-provisioning/blob/master/napalm/templates/arista-eos/

Nick