Help with sar -n DEV command in linux...

[Jupitus]

Hey guys... work related one here. Do any of you know if there is a known issue with the reporting of network activity on NIC interfaces using the above command in Linux? I am getting the following:

09:54:00 AM IFACE rxpck/s txpck/s rxbyt/s txbyt/s rxcmp/s txcmp/s rxmcst/s
09:55:00 AM lo 0.00 0.00 0.00 0.00 0.00 0.00 0.00
09:55:00 AM eth0 46.54 92.59 2978.35 107698.67 0.00 0.00 0.00
09:55:00 AM eth1 109.59 105.00 58487.08 7788.15 0.00 0.00 0.00

The figure I am most interested in is the bold figure which should be the received bytes per second on network interface eth1.

58487.08 bytes per second = approx. 467,000 bits per second, or 467 K.

Our switch stats feeding into this interface indicates we should be seeing a received data rate of the order of 4.6 Mb, i.e. 10x as much as this shows...


Any thoughts or suggestions please?

Thx.

 

[anattic]

It's a little fiddley, but you could go to the raw data and check that:

cat /proc/net/dev

should give you something like this...

Inter-|   Receive                                                |  Transmit
 face |bytes    packets errs drop fifo frame compressed multicast|bytes    packets errs drop fifo colls carrier compressed
    lo:150499021 1343675    0    0    0     0          0         0 150499021 1343675    0    0    0     0       0          0
  eth0:992150926 13167961    0    0    0     0          0        61 3206192128 4852490    0    0    0     0       0          0
  eth1:       0       0    0    0    0     0          0         0        0       0    0    0    0     0       0          0

If you work out the difference over a decent sampling period (say 30s), that should give you a feel for whether the app is talking rubbish or the NIC (or indeed the switch).

 

[Jupitus]

Thanks anattic - we'll try that.

 

[Sar]

I DON'T DO LINUX!