How is the network utilization calculated? How accurate is it?

EventSentry includes the Network Utilization (sometimes labeled Network Bandwidth) performance object which is located under "Packages - System Health - Performance System - Performance / SNMP". This counter measures the percentage of total bandwidth currently being consumed on the interface.

On Windows, it is calculated by dividing the Network Interface(*)\Bytes/sec performance counter by the Current Bandwidth and multiplying the result by 400.

With SNMP v2c, it is calculated with the following formula:
(1.3.6.1.2.1.31.1.1.1.6 + 1.3.6.1.2.1.31.1.1.1.10 / (1.3.6.1.2.1.31.1.1.1.15 * 1000000)) * 400

These calculations are necessary in order to convert between bits and bytes and take full duplex into consideration. The multiplier of 400 is set by the Windows performance counter calculation, and the SNMPv2 formula is adapted accordingly so that the result is still accurate.

In both cases, the divisor is the maximum bandwidth of the interface, usually based on the speed the network interface has negotiated with the switch. This calculation can be an issue when monitoring devices where the link speed of the interface does not correspond to the up-link speed available.

For example, you may want to monitor the bandwidth of your office's Internet connection and have added the router to EventSentry's configuration. If the WAN interface of the router supports Gigabit and it is plugged into a Gigabit port, then the bandwidth will be calculated based on Gigabit speed, even if your Internet connection only supports 100MBit.

Consequently, your network utilization will always only be 1/10 of what it actually is. A 1% reading will really mean a 10% utilization and so forth. In this case, you can manually override the secondary SNMP counter (divisor) to tell EventSentry the real speed of the interface.

To avoid having to create multiple "Network Utilization" performance objects, it's usually best to create a variable and then override the value of that variable on a per-host basis.

For example, click Tools > Variables and add a variable named INTERFACESPEED and assign "1.3.6.1.2.1.31.1.1.1.15" as the default value. OID 1.3.6.1.2.1.31.1.1.1.15 returns the interface speed in 1,000,000 bits per second (just like "Current Bandwidth" on Windows) and will therefore auto-detect the interface speed.

For hosts whose up-link speed differs from the interface speed, you can right-click a group or host in the management console and choose Set Variables to manually specify an interface speed for that group or host. Double-click the INTERFACESPEED variable and specify the actual up-link speed, for example if the max speed will be 100MBit you would use 100 as the new value of INTERFACESPEED . All other hosts still use the actual auto-detected interface speed for their calculation, since they are still using the default value of the variable.

Variables can also help to accommodate networks where devices support different versions of SNMP, since SNMP v1 and SNMP v2c/v3 use different SNMP OIDs for monitoring network bandwidth.

Once you are done configuring the variables, double-click the Network Utilization (or Network Bandwidth) performance counter, change the "Windows Counter" drop-down to "SNMP Counter" and then modify the Secondary Counter value at the bottom to be "$INTERFACESPEED*1000000". Save your changes and then restart the EventSentry Heartbeat Monitor service so that the next SNMP monitoring cycle can utilize the new variables.