Had a couple of utilisation alerts come through today reporting a 10Gig port as over 80% utilisation, when in reality it doesnt appear to be that busy?.

The alert email shows this graph, showing over 100% utilisation and a solid 80+% most of the day:

Inline images 1

When you click through the embedded link to the 'real' graph in Observium itself, it reports the correct utilisation figures I would epxect to see based on the traffic graph:

Inline images 2

Traffic graph for the port:

Inline images 3

Are the alerts reading the information from a different rrd? Doesn't seem like it as the port would be alarming constantly based on the graph in the email as it shows over 80% for most of the day?

Happy to accept that the port may have spiked to 8Gbps, but I would have thought this would have been reflected in the graphs somewhere but if anything traffic was tailing off?

Is there possibly an issue with the alerting on ifInOctets_perc or do I need to be looking more closely at what the device is reporting, which on face value _seems_ OK looking at a debug of poller.php?

Thanks,
Tim C