View Only

Work smarter! Transforming errored and discarded packet counts to percentages using SevOne synthetic indicators

By Tim Greenside posted Mon September 25, 2023 04:25 PM


I love a good SNMP counter as much as the next guy, but sometimes it would be nice if we could transform it or combine multiple counters into a more useful form, such as a percentage.  A couple of cases where this is true is when you are looking at interface errors or interface discards.  A counter tells you there may be some errors or some discards, but is the number significant enough to cause me to take action?  It's hard to tell from a raw count.  Now, if I could see the value in terms of the percentage of packets transmitted that contained errors or that were discarded, I could make a better determination of whether I should waste precious minutes of my day to investigate further.  Here's where synthetic indicators can help you out!

First things first, how does one go about determining what percentage of packets contain errors or are discarded?  Also, aren't interfaces full-duplex now-a-days?

To bake up a good interface synthetic indicator for errors or discards, we need the following indicators to be available for collection:  

  • ifInErrors, ifInDiscards, ifHCInUCastPkts, ifHCInMulticastPkts, ifHCInBroadcastPkts (for incoming traffic)
  • ifOutErrors, ifOutDiscards, ifHCOutUCastPkts, ifHCOutMulticastPkts, ifHCOutBroadcastPkts  (for outgoing traffic)

The interface error and discard counters are a count of the number of packets that are unable to be processed due to errors or due to interface buffers filling up, causing packets to be discarded.  So we need to use the following equations to turn the packet counts into percentages:

if%InErrors = ifInErrors / (ifInErrors + ifInDiscards + ifHCInUCastPkts + ifHCInMulticastPkts + ifHCInBroadcastPkts) * 100


if%OutErrors = ifOutErrors / (ifOutErrors + ifOutDiscards + ifHCOutUCastPkts + ifHCOutMulticastPkts + ifHCOutBroadcastPkts) * 100

We can define these in the SevOne "Object Types" Editor.

First we need to see whether the needed objects are enabled for collection.

  1. As NMS Administrator, navigate to Admininstration->Monitoring Configuration->ObjectTypes.
  2. To the right of the Filter:  "SNMP Poller" dropdown, search for 'interface' in the search text box.
  3. Highlight the 'Interface' row in the results below.
  4. In the 'Indicator Types' pane, search by "ifHC" to find the High Capacity Interface counter definitions, then toggle all of the "Default Allowed" flags to green so that these will be enabled for new devices.  This is important -- call it a "feature" -- SevOne will not just automatically add indicators to devices unless the indicator "Default Allowed" flags are set to green when the device is initially discovered.  There is another step that is required for existing devices... keep reading to find out what's next.

5.  In the Devices->Device Manager, edit existing devices that you want the indicators to be collected for by clicking on the "[Edit Indicator Types to Monitor]" button beneath the SNMP settings.

6.  Now select the unchecked indicators

7.   And then hit "Save Changes".

8.  Now re-discover the device to add the indicators to its collection.

IMPORTANT:   All indicators that are contained in a Synthetic Indicator equation must exist in a device's objects of interest or the system cannot create the synthetic indicator.  This is to prevent odd, unexpected results from being reported on.

9.  Now that all indicator types are present, let's add our synthetic indicators for our interfaces to the Administration->Monitoring Configuration->Object Types UI.  For each Synthetic Indicator, click "[+ Add Synthetic Indicator Type]" button.  

10.  In the expression editor, give your indicator a name.  Best practice is to prepend "s1_" to any synthetic indicator.  This makes it easier to identify synthetic indicators later from atomic indicators.  Give it a pretty description -- this is what your users will see.  Then drag and drop the indicators into the Synthetic Indicator Expression: window, adding the necessary syntax (divide = /, parenthesis, * 100 to get percentage value).  Fill in max percentage number as "100" (e.g. 100%).  and set the "Measure As" and "Display As" values to "Percent"

11.  Finally, save your work!

12.  Now go and rediscover a device to see your new synthetic indicator!  Please Note:  It will take two polling periods to generate a delta value so be patient!

Repeat the steps for the other synthetic indicators (ifIn%Discards, ifOut%Errors, if%OutDiscards)!