<![CDATA[traffic spike]]>Hello,

Was wondering if any of you have had issues with snmp bandwidth polling on netxms. Huge spikes showing up at a random basis is quite annoying - whether it being because of counter resets or what not. (screenshots attached)

My question is, is there a way to bypass this? I mean i have seen similar posts and found one of the devs mentioning a transformation script, which essentially just limits the maximum value your network can handle, then returns the max bandwidth your interface can handle ie
if ($1 > 1000)
  return 1000;
return $1;
OR some sort of a fixed value you assign via script, which I'd rather not use
Anyone got any ideas? is it possible to return the last polled value if the current poll exceeded the limit? or are there any other methods /ideas? thanks in advance 🙂

snmp.poll.history.jpg

]]>https://forum.netxms.org/topic/5468/traffic-spikeRSS for NodeFri, 13 Nov 2026 14:10:29 GMTTue, 27 Feb 2018 10:27:40 GMT60<![CDATA[Reply to traffic spike on Thu, 01 Mar 2018 20:17:00 GMT]]>Hi,

it is possible to access node's interface list from transformation script and read interface speed property, so it is possible to set cap on traffic value based on interface speed.

Best regards,
Victor

]]>https://forum.netxms.org/post/23966https://forum.netxms.org/post/23966Thu, 01 Mar 2018 20:17:00 GMT<![CDATA[Reply to traffic spike on Thu, 01 Mar 2018 02:12:21 GMT]]>Ha! you're right I did skim the post, apologies for not really helping!

I suppose the challenge is that all different types of equipment/vendor might have spikes to different values depending on how their SNMP implementation works in certain situations.  Differentiating a real spike vs an artifact could be hard to do.  I guess finding a generic one-size-fits all solution is the problem (no hardcoded values).

Thinking out loud, is there any way in NXSL to retrieve the node's current interface link speed and use that to dynamically set the max interface value in the transformation script.  Anything over and above that (maybe by a certain factor) is transformed as per the first link?

Guess it depends if there's any way to map a given SNMP DCI (maybe interface name) back to the relevant Node Interface object in order to retrieve the link speed value?

]]>https://forum.netxms.org/post/23960https://forum.netxms.org/post/23960Thu, 01 Mar 2018 02:12:21 GMT<![CDATA[Reply to traffic spike on Wed, 28 Feb 2018 06:59:19 GMT]]>hello,
thanks for the help (attempt) but i'm not sure that you actually read the whole post, nor the ones you linked yourself 😛
Yes I have seen both posts, but I'm looking for a better, more accurate solution and i explained why in the op.

]]>https://forum.netxms.org/post/23949https://forum.netxms.org/post/23949Wed, 28 Feb 2018 06:59:19 GMT<![CDATA[Reply to traffic spike on Wed, 28 Feb 2018 02:24:17 GMT]]>I've used the scripts in this blog post when searching for DCI spike removal.
https://lasiszm.wordpress.com/2017/10/22/netxms-template-for-monitoring-mikrotik-interfaces/

Looks like this question has been asked in the forums too:
https://www.netxms.org/forum/feature-requests/dci-spike-removal/

]]>https://forum.netxms.org/post/23948https://forum.netxms.org/post/23948Wed, 28 Feb 2018 02:24:17 GMT