Normal Cacti Network Traffic Graphs poll SNMP every 5 minutes (typical) and show the traffic during that time - ie. the average over that 5 minutes. That's fine for a lot of stuff, but the nature of public websites is that there can be very short term saturation of connections when the browser hits a page and downloads everything in that page. That happens in a matter of seconds and the existing Cacti graphs tell nothing about what happened during those few seconds.

Rapid polling daemon

The problem comes down to one of reducing the time between polls. Obviously a time of a few seconds would be impractical for Cacti to update thousands of data sources not to mention the hammering the monitored nodes would get with all the SNMP Traffic.

The easiest solution I could come up with was to write a tiny daemon in perl that ran on the monitored node and polls the network traffic counters periodically and then maintains a rolling stats file somewhere that a snmpd extension can pick it up.

Download: Network Peak Traffic polling daemon (perl)

Download: init.d script for Network Peak Traffic daemon

As this is unpackaged software typically the daemon will go in /usr/local/sbin and the init.d script in /etc/init.d to start the daemon at boot. Both scripts will need to be made executable. If you use different locations then you may need to alter scripts accordingly. On Debian systems run the update script for init.d scripts:

# update-rc.d local-netmond defaults

You will also need some config in /etc/default/netpeakmond which is picked up by the init.d script:

# command line options for netmond
DAEMON_OPTS='5 360 30 /var/local/snmp/netpeak'

The options in order are:

• Network traffic polling time - 5 seconds
• Peak hold time - 360 seconds = 6 minutes which should be plenty time for Cacti to collect it
• Stats file update time - every 30 seconds
• Stats file path.... same place as I put all the other var stuff for my local snmpd extensions

Once that's sorted you can start the daemon via the init.d script:

# /etc/init.d/local-netpeakmond start

Once that's running the stats file should be created and you should see it updating roughly every 30 seconds

snmpd Extensions

I've done a tiny extension script to pick out the data for smnpd. Again, if you are putting your stats file in a different location then you need to update the script accordingly.

Download: Network Peak Traffic snmpd extension script

I put that script in /etc/snmpd with all the snmpd config, of course making it executable. Update /etc/snmp/snmpd.conf with the following lines to use the script:

extend netpeakdev /etc/snmp/netpeak-stats-generic devs
extend netpeaktx /etc/snmp/netpeak-stats-generic tx
extend netpeakrx /etc/snmp/netpeak-stats-generic rx

Restart snmpd and you should be in business.

Cacti

This template uses Indexed SNMP to find all your network devices so there is an xml Data Query needed.

Download: Cacti Network Peak Traffic Data Query

As a local (unpackaged) file, I put this in /usr/local/share/cacti/resource/snmp_queries/ and the template is expecting it there so it will need modifying if you put it in an alternative location.

Download: Cacti Network Peak Traffic Template

The Cacti template is derived from the existing Cacti Network Traffic Templates so it looks the same for easy comparison.

Add the Data Query to the host and then you should be able to add graphs for all the relevant devices on the host.

The Graphs