[88899] in North American Network Operators' Group
Re: How do you (not how do I) calculate 95th percentile?
daemon@ATHENA.MIT.EDU (Tom Sands)
Wed Feb 22 17:18:45 2006
Date: Wed, 22 Feb 2006 16:18:08 -0600
From: Tom Sands <tsands@rackspace.com>
To: "David W. Hankins" <David_Hankins@isc.org>
Cc: nanog@merit.edu
In-Reply-To: <20060222202514.GA413@isc.org>
Errors-To: owner-nanog@merit.edu
David W. Hankins wrote:
> On Wed, Feb 22, 2006 at 12:50:34PM -0600, Tom Sands wrote:
>
>>>A lot of smaller folks check the counter every 5 min and use that same
>>>value for the 95th percentile. Most of us larger folks need to check more
>>>often to prevent 32bit counters from rolling over too often.
>>
>>Actually, a lot of people do 5 minutes... and I would say that larger
>>companies don't check them more often because they are using 64 bit
>>counters, as should anyone with over about 100Mbps of traffic.
>
>
> Counter size is an incomplete reason for polling interval.
>
Possibly incomplete, but a reason for some none the less, if all they
can do is 32 bit counters.
> If you need a 5 minute average and poll your routers once every five
> minutes, what happens if an SNMP packet gets lost?
>
No one said it was "needed", just what is done.. and I agree with your
reason of more frequent polling, than doing it because of counter roll.
> In the best case, a retransmission over Y seconds sees it through, but
> now you've got 300+Y seconds in what was supposed to be a 300 second
> average...your next datapoint will also now be a 300-Y average unless
> you schedule it into the future.
>
> In the worst case, you've lost the datapoint entirely. This loses not
> just the one datapoint ending in that five minute span, but also the
> next datapoint. Sure, you can synthesize two 5 minute averages from
> one 10 minute average (presuming your counters wouldn't roll), but this
> is still a loss in data - one of those two datapoints should have been
> higher than the other.
>
>
>
>>In our setup, as with a lot of people likely, any data that is older
>>than 30 days is averaged. However, we store the exact maximums for the
>>most current 30 days.
>
>
> You keep no record? What do you do if a customer challenges their
> bill? Synthesize 5 minute datapoints out of the larger averages?
>
This isn't for customer billing. We don't bill customers on Mbps, but
rather on total volume of GB transfered. That is an easy number to
collect and doesn't depend on 5 minute itervals being successful. Right
up until someone clears the counters ;)
> I recommend keeping the 5 minute averages in perpetuity, even if that
> means having an operator burn the data to CD and store it in a safe (not
> under his desk in the pizza boxes, nor under his soft drink as a coaster).
>
--
------------------------------------------------------
Tom Sands
Chief Network Engineer
Rackspace Managed Hosting
(210)447-4065
------------------------------------------------------
