Normal Cacti (and many other tools) Network Traffic Graphs poll SNMP every 5 minutes (typical) and show the traffic during that time - ie. the average over that 5 minutes. That's fine for a lot of stuff, but the nature of public websites is that there can be very short term saturation of connections when the browser hits a page and downloads everything in that page. With very high bandwidth connections becoming common this becomes more of a problem and even a few users hitting pages near simultaneously could now bump an already busy site against the limits for periods of a few seconds at a time.

With ecommerce and other revenue generating sites, page load times have been shown to have a relationship to revenue so this blind spot can cost money. It's a matter of seconds that count for this and the existing graphs in minutes tell nothing about what happened during those critical few seconds.

This aims to change that.

Rapid polling daemon

The problem comes down to one of reducing the time between polls. Obviously a time of a few seconds would be impractical for Cacti to update thousands of data sources not to mention the hammering the monitored nodes would get with all the SNMP Traffic.

The easiest solution I could come up with was to write a tiny daemon (in perl this time) that ran on the monitored node and polls the network traffic counters periodically and then maintains a rolling stats file somewhere that a snmpd extension can pick it up.

You will need netpeakmond (perl) and init.d-netpeakmond (shell init script).

Download: Network Peak Monitoring Daemon is now on GitHub

As this is unpackaged software typically the netpeakmond daemon will go in /usr/local/sbin and the init.d script in /etc/init.d renamed to local-netpeakmond or similar to start the daemon at boot. Both scripts will need to be made executable. If you use different locations then you may need to alter scripts accordingly. On Debian systems run the update script for init.d scripts:

# update-rc.d local-netmond defaults

You will also need some config in /etc/default/netpeakmond which is picked up by the init.d script:

# command line options for netmond
DAEMON_OPTS='5 360 30 /var/local/snmp/netpeak'

The options in order are:

• Network traffic polling time - 5 seconds (you could go shorter if you wanted)
• Peak hold time - 360 seconds = 6 minutes which should be plenty time for Cacti to collect it
• Stats file update time - every 30 seconds
• Stats file path.... same place as I put all the other var stuff for my local snmpd extensions

Once that's sorted you can start the daemon via the init.d script:

# /etc/init.d/local-netpeakmond start

Once that's running the stats file should be created and you should see it updating roughly every 30 seconds

snmpd Extensions

I've done a tiny extension script to pick out the data for smnpd. Again, if you are putting your stats file in a different location then you need to update the script accordingly.

I put the snmpd extension script netpeak-stats-generic in /etc/snmpd with all the snmpd config, of course making it executable. Update /etc/snmp/snmpd.conf with the following lines to use the script:

extend netpeakdev /etc/snmp/netpeak-stats-generic devs
extend netpeaktx /etc/snmp/netpeak-stats-generic tx
extend netpeakrx /etc/snmp/netpeak-stats-generic rx

Restart snmpd and you should be in business.

Cacti

This template uses Indexed SNMP to find all your network devices so there is an xml Data Query needed.

Next you will need the data query netpeak.xml. As a local (unpackaged) file, I put this in /usr/local/share/cacti/resource/snmp_queries/ and the template is expecting it there so it will need modifying if you put it in an alternative location.

Import the Cacti template cacti_data_query_network_peak_traffic.xml. The template is derived from the existing Cacti Network Traffic Templates so it looks the same for easy comparison.

Add the Data Query to the host and then you should be able to add graphs for all the relevant devices on the host.

The Graphs