RMON - Absolute vs Delta

Hi,

 

Could somebody explain (in laymen terms!) when and why you would use Absolute over Delta and vice-versa when setting up RMON alarms?

 

Thanks

 

Combatant101

 

Comments

  • Delta is to measure a change in a value over time, and absolute is when you want to measure an absolute value.

    Let me give you an example to see if this helps.

     

    Delta - Packets leaving an interface would be an example. If you set the interval at 60 sec thats measure the number of packets leaving the interface during this period. If you put absolute here, once it hits the value it will trigger the event, and not again (unless the counters are cleared and the value is hit)

     

    Absolute - Lets use this rxload on an interface. Since this is 1/255, you can set an absolute rmon to trigger an event everything time it hits 200 (can set a falling thresh as well). CPU could be another exmple.

     

    HTH,

    Rob



  • Delta : For values that always increase
    Absolute : For values that can increase or decrease

    CPU utilization can go up or down (0% to 100%) so it would be an absolute value.  Packets entering an interface will always accumulate (until the counters are cleared) so this would be a delta value.  We’re (more likely to be*) interested in the number of packets during a certain interval (say the last 5 minutes) instead of the total number of packets since the counters were last cleared.

    One of the ways that I determine whether to use absolute or delta is whether or not the “falling-threshold” can be attained.  If a task has you configure a falling-threshold that cannot be reached (after the rising-threshold has been met) then I choose to use ‘delta’.  For instance, if the task is referring to inbound packets (a value that always increases) and has a rising-threshold of 100 and a falling-threshold of 50, you can use ‘absolute’ but once the rising threshold is breached, the falling-threshold cannot be attained (unless the counters are cleared).  This is either a poorly written task…or more likely you should use ‘delta’.

    *Sure, we could monitor the absolute value of packets and generate an alarm when packets reach  certain value (say 1 million) but that’s a pretty strange/ineffective alarm.

     

     



    HTH...

    Deepak Arora

    http://www.deepakarora1984.blogspot.com

  • Hi Deepak!

    I would like to reward and feature you on our blog - like this:


    Please contact me directly.

    Sent from my iPad

    On Dec 15, 2010, at 2:27 AM, "Deepak Arora" <[email protected]> wrote:



    Delta : For values that always increase
    Absolute : For values that can increase or decrease

    CPU utilization can go up or down (0% to 100%) so it would be an absolute value.  Packets entering an interface will always accumulate (until the counters are cleared) so this would be a delta value.  We’re (more likely to be*) interested in the number of packets during a certain interval (say the last 5 minutes) instead of the total number of packets since the counters were last cleared.

    One of the ways that I determine whether to use absolute or delta is whether or not the “falling-threshold” can be attained.  If a task has you configure a falling-threshold that cannot be reached (after the rising-threshold has been met) then I choose to use ‘delta’.  For instance, if the task is referring to inbound packets (a value that always increases) and has a rising-threshold of 100 and a falling-threshold of 50, you can use ‘absolute’ but once the rising threshold is breached, the falling-threshold cannot be attained (unless the counters are cleared).  This is either a poorly written task…or more likely you should use ‘delta’.

    *Sure, we could monitor the absolute value of packets and generate an alarm when packets reach  certain value (say 1 million) but that’s a pretty strange/ineffective alarm.

     

     



    HTH...

    Deepak Arora

    http://www.deepakarora1984.blogspot.com




    Internetwork Expert - The Industry Leader in CCIE Preparation

    http://www.internetworkexpert.com



    Subscription information may be found at:

    http://www.ieoc.com/forums/ForumSubscriptions.aspx
  • Hi Anthony,

     

    Thanks for being so generous. Will send you email soon....

     



    HTH...

    Deepak Arora

    http://www.deepakarora1984.blogspot.com



Sign In or Register to comment.