Forum Discussion

Dan_Massameno's avatar
Dan_Massameno
10 years ago

OutputDiscardPercent Too Noisy

I noticed on some of my links the alarm for OutDiscardPercent was very noisy. It\'s setup to run an alarm when it is above 1%. It\'s calculated with...

if(eq(OutUcastPkts+OutBroadcastPkts+OutMulticastPkts, 0), 0, OutDiscards*100/(OutUcastPkts+OutBroadcastPkts+OutMulticastPkts+OutDiscards))

I\'d suggest that 1% is a fine alarm threshold for a link that is seeing normal traffic (i.e., a link that is in use and seeing >10 pps.) Below 10 pps is background noise (hello packets, keepalives, etc.) and doesn\'t need this kind of alarm.

Interestingly, the InputDiscardPercent has this check built in…

if(gt(InUcastPkts,10),InDiscards*100/(InBroadcastPkts+InUcastPkts+InMulticastPkts),0)

I suggest building this kind of check into Output Discard Percent…

if(gt(OutUcastPkts, 10), OutDiscards*100/(OutUcastPkts+OutBroadcastPkts+OutMulticastPkts+OutDiscards), 0)

While we’re at it, the InputDiscardPercent is missing a term in the denominator. It doesn\'t account for InDiscards, so the percentage is artificially inflated. Corrected it would like this..

if(gt(InUcastPkts,10),InDiscards*100/(InBroadcastPkts+InUcastPkts+InMulticastPkts+InDiscards),0)

These two fixes would reduce “false†alarms on low-volume links, correctly calculate the proper percentages and harmonize the two calculations so they match.

  • Steve_Francis's avatar
    Steve_Francis
    Former Employee
    10 years ago

    Quite correct on the InputDiscard alert - it should have been including InDiscards. That is corrected in core now, thanksrnRe output discards - my question here is, if you are seeing output discards on an interface that is doing less than 10 pps, isnt that a cause for concern/investigation? Input packets can be discarded at low volumes as sometimes that is how systems treat packets not addressed to their MAC addresses (if a switch is flooding out an unknown destination, say).rnBut why would you ever have output discards, coupled with a low packet rate? Love to see some examples, and learn why... Thanks for the feedback!

  • Dan_Massameno's avatar
    Dan_Massameno
    10 years ago

    I think we have a rather nice example I can provide you! rnWe have a site where the WAN link is in place but the site is not live yet. Itu2019s doing about 0.2 packets per second. Iu2019m guessing this is just Ciscou2019s Next Hop Routing Protocol or some other innocuous heartbeat.rnThis is a tunnel interface across the WAN so the MTU is only 1434 bytes. When it gets a packet that is between 1435 and 1500 bytes it drops it, sends an ICMP Packet Too Big message back to the source and increments the Discard counter.rnUnfortunately this results in about 0.04 pps of discards. My guess is some very small probe-type packet is going out to the site and the packet is >1434 bytes large. rnSo there you have it. A very small amount of background noise measured against an even smaller amount of background noise yields 16% discards! This is not actionable information. :-)