RMON Absolute VS Delta

RMON can monitor certain SNMP MIBs and generate an event for a certain threshold. One of the things you have to do when configuring RMON is choose between absolute or delta sampling. In short, this is the difference between the two:

• Delta: values that always constantly increase OR constantly decrease.
• Absolute: values that can increase or decrease.

Delta should be used for values that will always increase or decrease (one of the two), for example, interface counters like the number of input errors, CRC errors, output packets, interface resets, etc. These are values that will always increase unless you reset the interface counters. I can’t think of any counters on a Cisco router or switch that always decrease.

Absolute should be used for values that increase or decrease over a certain amount of time. A good example is CPU usage. You probably want to receive a notification each time your CPU load hits a certain threshold (like 85%) and receive a notification when it goes below another threshold (10% or so). This is absolute sampling.

Another example of absolute sampling could be the input or output rate of an interface, as this can increase or decrease over the span of time. At one moment, it might be 10.000 bits/sec. 10 minutes later, it could be 5.000 bits/sec, and 45 minutes later, it might be 20.000 bits/sec.

I hope this helps to understand the difference between the two. If you need some more examples just leave a comment.