RMON Absolute VS Delta

RMON can be used to monitor certain SNMP MIBs and generate an event for a certain threshold. One of the things you have to do when configuring RMON is choosing between absolute or delta sampling. In short, this is the difference between the two:

  • Delta: values that always constantly increase OR constantly decrease.
  • Absolute: values that can increase or decrease.

Delta should be used for values that will always increase or decrease (one of the two), for example interface counters like the number of input errors, CRC errors, output packets, interface resets etc. These are values that will always increase unless you reset the interface counters. I can’t think of any counters on a Cisco router or switch that always decrease.

Absolute should be used for values that increase or decrease over a certain amount of time, a good example is CPU usage. You probably want to receive a notification each time when your CPU load hits a certain threshold (like 85%) and receive a notification when it goes below another threshold (10% or so), this is absolute sampling.

Another example of absolute sampling could be the input or output rate of an interface as this can increase or decrease over the span of time. At one moment it might be 10.000 bits/sec, 10 minutes later it could be 5.000 bits/sec and 45 minutes later it might be 20.000 bits/sec.

I hope this helps to understand the difference between the two. If you need some more examples just leave a comment.

Tags:


Forum Replies

  1. very nicely written in simple english. Just understood in one go :slight_smile:

  2. Hi Rene
    Does this feature RMON is useful ? Is it possible to use in a production environment where we have tools like nagis or prtg ?
    Can we monitor during a long period using cli ?

    Cordially

  3. Hello Fabrice

    According to sources, RMON is a standard monitoring specification that enables various network monitors and console systems to exchange network-monitoring data. RMON provides network administrators with more freedom in selecting network-monitoring probes and consoles with features that meet their particular networking needs. RMON actually uses SNMP for both agent configuration and data collection, however it differs from SNMP in that it focuses more on “flow-based” rather than “device-based” management. RMON is actually similar to NetFlow and SF

    ... Continue reading in our forum

Ask a question or join the discussion by visiting our Community Forum