[ixpmanager] SFLOW Under Reporting?

[Nick Hilliard (INEX)]

Ian Chilton wrote on 26/06/2023 09:50:
> Right now we're doing 667G exchange traffic with MRTG, 280G with the 
> original sflow setup, 317G with the new VM (+subinterfaces fix) and 468G 
> on bare metal. So still a long way under actual interface traffic, but a 
> lot better.

that definitely points towards a performance issue of some form. My 
initial suspicion would be tail drops due to a buffer overflow on the 
pipe between the sflowtool process and sflow-to-rrd-handler.  You can 
test this out easily by increasing the flushtimer to 300 seconds. This 
won't fix the underlying problem, but if it improves the match between 
mrtg and sflow numbers, then it suggests a specific root cause.

Nick