# How do you (not how do I) calculate 95th percentile?

Tom Sands tsands at rackspace.com
Wed Feb 22 22:18:08 UTC 2006

```
David W. Hankins wrote:

> On Wed, Feb 22, 2006 at 12:50:34PM -0600, Tom Sands wrote:
>
>>>A lot of smaller folks check the counter every 5 min and use that same
>>>value for the 95th percentile.  Most of us larger folks need to check more
>>>often to prevent 32bit counters from rolling over too often.
>>
>>Actually, a lot of people do 5 minutes... and I would say that larger
>>companies don't check them more often because they are using 64 bit
>>counters, as should anyone with over about 100Mbps of traffic.
>
>
> Counter size is an incomplete reason for polling interval.
>

Possibly incomplete, but a reason for some none the less, if all they
can do is 32 bit counters.

> If you need a 5 minute average and poll your routers once every five
> minutes, what happens if an SNMP packet gets lost?
>

No one said it was "needed", just what is done.. and I agree with  your
reason of more frequent polling, than doing it because of counter roll.

> In the best case, a retransmission over Y seconds sees it through, but
> now you've got 300+Y seconds in what was supposed to be a 300 second
> average...your next datapoint will also now be a 300-Y average unless
> you schedule it into the future.
>
> In the worst case, you've lost the datapoint entirely.  This loses not
> just the one datapoint ending in that five minute span, but also the
> next datapoint.  Sure, you can synthesize two 5 minute averages from
> one 10 minute average (presuming your counters wouldn't roll), but this
> is still a loss in data - one of those two datapoints should have been
> higher than the other.
>

>
>
>>In our setup, as with a lot of people likely, any data that is older
>>than 30 days is averaged.  However, we store the exact maximums for the
>>most current 30 days.
>
>
> You keep no record?  What do you do if a customer challenges their
> bill?  Synthesize 5 minute datapoints out of the larger averages?
>

This isn't for customer billing.  We don't bill customers on Mbps, but
rather on total volume of GB transfered.  That is an easy number to
collect and doesn't depend on 5 minute itervals being successful.  Right
up until someone clears the counters  ;)

> I recommend keeping the 5 minute averages in perpetuity, even if that
> means having an operator burn the data to CD and store it in a safe (not
> under his desk in the pizza boxes, nor under his soft drink as a coaster).
>

--
------------------------------------------------------
Tom Sands
Chief Network Engineer
Rackspace Managed Hosting
(210)447-4065
------------------------------------------------------

```