Uploaded image for project: 'OpenNMS'
  1. OpenNMS
  2. NMS-13534

Nephron: Fix host traffic aggregations

    XMLWordPrintable

Details

    • Bug
    • Status: Open (View Workflow)
    • Minor
    • Resolution: Unresolved
    • None
    • None
    • None
    • Security Level: Default (Default Security Scheme)
    • 13
    • Reviewed

    Description

      When calculating the "Other" part that is not covered by the topK hosts the total volume that is used to determine that other part has to be doubled.

      Assume the following flows reported for an exporter/interface:

      src dst direction bytes
      h1 h2 in b1
      h1 h2 out b2
      h1 h3 in b3
      h1 h3 out b4

      The total volume for that exporter/interface is:

      in out
      b1+b3 b2+b4

      When deriving host aggregations the observed traffic is assigned to both, the src and dst hosts. In case of the example flows the derived host aggregations are:

      host in out
      h1 b1+b3 b2+b4
      h2 b1 b2
      h3 b3 b4

      When the host aggregations are summed up the total is:

      in out
      2*(b1+b3) 2*(b2+b4)

      In case of a top-1 aggregation the result including the "Other" part is:

      host in out
      h1 b1+b3 b2+b4
      Other 2*(b1+b3) - (b1+b3) = b1+b3 2*(b2+b4) - (b2 + b4) = b2+b4

      In case of a top-2 aggregation (assuming b1+b2 > b3+b4) the result including the "Other" part is:

      host in out
      h1 b1+b3 b2+b4
      h2 b1 b2
      Other 2*(b1+b3) - (b1+b3) - b1 = b3 2*(b2+b4) - (b2 + b4) - b2 = b4

      Alternatives

      There are two alternatives how traffic volumes could be assigned to hosts:

      1. ingress bytes and egress bytes could be divided by two and assigned to both hosts as before
      2. ingress bytes could be assigned to the source host and egress bytes to the destination host

      The first alternative has the advantage that host volumes would sum up to the total exporter/interface volume. The disadvantage is that for each host the ingress/egress bytes now are only half of the value reported in flows.

      The second alternative also has the advantage that host volumes sum up to the total exporter/interface volume. The ingress / egress numbers separate the traffic when a host was the source host and when a host was the target host. The disadvantage is that the current aggregation scheme that first calculates aggregations for conversations must be changed. Conversations do not distinguish between src and dst host. Therefore they can not be used as the base for deriving host aggregations.

      Attachments

        Issue Links

          Activity

            People

              swachter Stefan Wachter
              swachter Stefan Wachter
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

                Created:
                Updated:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.