output queue drops

[Guest_imported]

Hi,
I'm having the following problem:
- on a cisco 2524, when I view the serial interface statistics there are lot of output drops although the bandwidth usage is not very high. We have a T1 line with several servers connected to the ethernet interface. We narrowed down the source of the droped packets to a web servers which get a moderate number of hits. Quite possible the reson is that we might need to upgrade the T1, but after talking to Sprint (our ISP) they said that they don't see that much bandwidth utilization. The issues is that from time to time requests to the servers time out and we get around 25-30% packet loss when pinging the machines from an outside network. If we stop the IIS on the main web server everything id just fine, but as soon as we start it the number of drops increases exponentially. We run virus check but weren't able to find anything.
Do you think this is still a bandwidth issue, or there is something fishy here. What bothers me is that according to Sprint the bandwidth utilization is low, but we still have these drops.


Serial0 is up, line protocol is up
Hardware is HD64570 with FT1 CSU/DSU
Description: To Sprint
Internet address is x.x.x.x/x
MTU 1500 bytes, BW 1544 Kbit, DLY 20000 usec, rely 255/255, load 169/255
Encapsulation HDLC, loopback not set, keepalive set (10 sec)
Last input 00:00:02, output 00:00:00, output hang never
Last clearing of "show interface" counters 00:26:54
Input queue: 0/75/0 (size/max/drops); Total output drops: 441
Queueing strategy: weighted fair
Output queue: 5/1000/64/441 (size/max total/threshold/drops)
Conversations 2/27/256 (active/max active/max total)
Reserved Conversations 0/0 (allocated/max allocated)
5 minute input rate 130000 bits/sec, 166 packets/sec
5 minute output rate 1029000 bits/sec, 182 packets/sec
264762 packets input, 24926624 bytes, 0 no buffer
Received 162 broadcasts, 0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
303928 packets output, 217616416 bytes, 0 underruns
0 output errors, 0 collisions, 0 interface resets
0 output buffer failures, 0 output buffers swapped out
0 carrier transitions
DCD=up DSR=up DTR=up RTS=up CTS=up

 

[benzito]

To find your utilization just divide the load by the reliability and x's it by 100. So in the stat above your right around 66.27% utilization of your t1. At times you may be bursting over the circuits' capacity and that may be causing the drops. Another thing to check is the MTU on your web server. Ideally it should not be set any higher than the MTU of the router <1500>. Otherwise the router will be spending a lot of time fragmenting packets instead of forwarding them.

Check cisco's web page on input / outout drops for more info

http://www.cisco.com/warp/public/63/queue_drops.html

 

[Guest_imported]

Hi there

looking at the 5 min average you might from time to time hit the ceiling of the t1

try setting the load-interval on the interface to 30 sec's that might show the peaks.
conf t
int s 0
load-interval 30

The drops can also be caused by an accesslist that is configured. hits on the deny statements show up as drops.

greets, maarten

 

[wybnormal]

Your vendor should be able to provide a report that shows actual line usage over time with peak loads. If you want accurate statistics, then use some type of SNMP tool to read the serial port statistics. Solarwinds has a very good reporting tool with a 30 day demo. It's limited to 5 devices and 1 or 2 interfaces per device but that would be enough.

A second way to get good stats is to use a sniffer on the webserver link. get a solid baseline and then start filtering to see what when is giving you the headache..

Even if you burst over the CIR, you should not be dropping unless the telco playing games.. The load on the serial port &quot;show port Sx&quot; is misleading.. it's not a real time nor is it a true load reading. It's an average(?? math wizards, forgive my butchering of Math terms). Here is what Cisco says about it:
:::snip:::
The load is a 5-minute exponentially weighted average that is updated every five seconds.
:::snip::

So you can see that trying to calculate the utilization from the load numbers would be incorrect. You need to get them from the SNMP counters.

MikeS
Find me at

http://www.packetattack.com

&quot;The trouble with giving up civil rights is that you never get them back&quot;