Graph subscribers in Cacti#

Graph each subscriber's traffic in Cacti the way you graph a router interface: one row per subscriber, picked by name, with 64-bit byte and packet counters.

You will need: Cacti 1.2 or later with a device for the appliance, and SNMP access to the appliance from the Cacti poller.

How it works#

The appliance serves bngSubscriberTable (.1.3.6.1.4.1.66418.22, in the NETAVO-BNG-MIB). Its columns copy IF-MIB's ifXTable, so Cacti's stock interface templates work against it.

The index belongs to the subscriber. A subscriber keeps their index when they reconnect, and also across control-plane restarts and reboots. An index is never given to anyone else.
Counters only go up. A reconnect starts the data plane's session counters again from zero. The table carries on from where the subscriber's last session left off, so a redial never shows up as a spike.
A disconnected subscriber keeps their row. Its status is 2 (down) and its counters stop moving. A row is removed only after the subscriber has been unseen for snmp subscriber-table retention-days (default 30).
In is traffic from the subscriber (their upload). Out is traffic to them (their download). This is the same as on a router interface.
Each appliance has its own indexes. A line that redials onto the other LNS of a pair shows up in that appliance's table. The Cacti kit joins them up again: see One graph per subscriber across appliances.

1. Give Cacti access to the table#

The table holds subscriber names and addresses. An SNMPv2c community sends these in clear text, so remote communities cannot read the table unless you allow it.

Preferred: an SNMPv3 user with privacy.

set snmp user cacti auth-protocol sha-256
set snmp user cacti auth-password <8+ characters>
set snmp user cacti priv-protocol aes
set snmp user cacti priv-password <8+ characters>
commit

In Cacti, set the device to SNMP version 3, security level authPriv, auth protocol SHA256, privacy protocol AES128, using the same passphrases.

Or: allow a v2c community (only if the path to the poller is trusted).

set snmp ro-community <community> sources <poller address>
set snmp ro-community <community> subscriber-table true
commit

The commit rewrites snmpd.conf and restarts snmpd. The control plane is not restarted and no subscriber is affected; SNMP stops answering for a few seconds while snmpd comes back.

2. Install the data query and templates#

The appliance's Cacti kit is two files:

netavo_bng_subscribers.xml — the data query.
bng_cacti_subscribers.php — a script that creates everything the data query needs in Cacti and keeps the graphs in step with the table.

On the Cacti server, copy the XML to <cacti>/resource/snmp_queries/ and the script to <cacti>/cli/. Then run the script once, as the user the poller runs as:

sudo -u www-data php <cacti>/cli/bng_cacti_subscribers.php --install

This creates, and leaves alone if they already exist:

Object	Name
Data query	`NetavoBNG - Subscribers`
Data template	`NetavoBNG - Subscriber Traffic`
Graph template	`NetavoBNG - Subscriber Traffic (bits/sec)`
Automation graph rule	`NetavoBNG - Subscriber Graphs`

The templates are copies of Cacti's stock interface traffic templates with two changes. The graph is labelled Download and Upload, with download as the filled area. And the data template has a fixed maximum instead of one taken from the interface speed, because an unshaped plan reports a speed of 0 and a maximum of 0 discards every reading.

3. Graph an appliance's subscribers#

Find the appliance's device id (Console › Management › Devices), then:

sudo -u www-data php <cacti>/cli/bng_cacti_subscribers.php --add-host --host-id=<id>

This adds the data query to the device, reads the table, and creates one graph per subscriber titled <device> - Subscriber - <name>. Expect about a second for every six subscribers. The graphs start to draw after two polls.

A device added from the command line is not on a graph tree. To browse its graphs under Graphs, add it once:

sudo -u www-data php <cacti>/cli/add_tree.php --type=node --node-type=host --tree-id=1 \
  --host-id=<id> --host-group-style=1

4. Pick up new subscribers automatically#

Two things create a graph for a subscriber who appears later:

The device's re-index method is Index Count Changed. The poller notices on its next run that the table has a different number of rows, re-reads it, and the automation rule graphs the new rows. Graph automation must be on (Console › Configuration › Settings › General).
A scheduled run catches what a row count cannot: one subscriber retired and another added between two polls leaves the count the same. Add it to cron:

17 * * * * www-data php <cacti>/cli/bng_cacti_subscribers.php --sync >> /var/log/cacti/bng-subscribers.log 2>&1

--sync re-reads the table on every device that has the data query, and prints one line per device with the number of graphs it added, then one line for the aggregates (section 6). Existing subscribers keep their indexes, so their graphs are not affected.

5. Remove graphs of subscribers who have gone#

A subscriber's row is removed after snmp subscriber-table retention-days unseen. Cacti keeps the graph. To see such graphs, and then to delete them with their data:

sudo -u www-data php <cacti>/cli/bng_cacti_subscribers.php --prune
sudo -u www-data php <cacti>/cli/bng_cacti_subscribers.php --prune --apply

--prune alone only lists. --apply deletes the graphs and their history, and cannot be undone. It refuses to run for a device whose table came back empty, so a failed read cannot delete everything. --status shows subscribers, graphs and orphans per device without changing anything.

6. One graph per subscriber across appliances#

A line that can connect to any of several appliances has a graph on each one it has used, and each of those is flat while the line is elsewhere. --sync also keeps one aggregate graph per subscriber name, titled Subscriber - <name>, that adds the subscriber's graphs from every device together. Only one appliance carries the line at a time, so the sum is the subscriber's traffic, with no gap where the line moved.

Find them on the graph tree under BNG Subscribers, or in Console › Management › Aggregates.
An aggregate stores nothing. It draws from the per-appliance graphs, so a subscriber's history from before a move is there as soon as both appliances are in Cacti.
When a subscriber first appears on another appliance, the next --sync adds that appliance's graph to their aggregate.
Subscribers are matched by name (ifName). Two different subscribers with the same name on different appliances would be added together.
--prune --apply (without --host-id) also removes the aggregate of a subscriber that no appliance reports any more.

Graph the appliance itself#

bng_cacti_box.php graphs every other number in the MIB: sessions, drops, CG-NAT, each worker, each port, each address pool. It walks the appliance, so it graphs what that appliance serves and needs no list kept in step with the MIB. Copy it to <cacti>/cli/ and NETAVO-BNG-MIB.mib to <cacti>/resource/snmp_queries/ (the graph titles come from it), then:

sudo -u www-data php <cacti>/cli/bng_cacti_box.php --list --host-id=<id>
sudo -u www-data php <cacti>/cli/bng_cacti_box.php --add-host --host-id=<id>

--list shows what would be graphed and changes nothing. --add-host creates one graph per value and skips any the device already has, so run it again after an upgrade, or after adding a port or a pool, to pick up what is new.

Verify#

From the Cacti server, walk the subscriber names:

snmpwalk -v3 -l authPriv -u cacti -a SHA-256 -A '<auth>' -x AES -X '<priv>' \
  <appliance> 1.3.6.1.4.1.66418.22.1.1

Each line is …22.1.1.<index> = STRING: <subscriber>. Walk …22.1.5 and …22.1.6 for the in/out byte counters.

Nothing comes back with v2c, but the rest of the MIB does: the community has not been allowed to read the table (step 1).
The table is empty: no subscriber has connected yet, or snmp subscriber-table enabled is false.

Notes#

sessionActive (column .22.1.11) is 1 while the subscriber has a session and 0 when they do not. It holds the same information as ifOperStatus, but as a plain gauge, so a GAUGE data source can graph it as an online/offline line or sum it across subscribers.
The appliance writes the index and counter state to disk every snmp subscriber-table flush-interval seconds (default 300), and only if something changed. A new subscriber's index is written within 30 seconds.
ifHighSpeed is the subscriber plan's fastest rate in Mbit/s, rounded up. It is 0 for an unshaped plan. If you map the stock interface templates onto the data query yourself, check how the data template sets its maximum value: a maximum taken from the interface speed, applied to a 0, discards every reading for that subscriber. The kit's template does not do this.
Each subscriber adds two values to every poll. Cacti's PHP poller reads them one at a time; for more than a few thousand subscribers per poller, use spine.
Guest sessions on an access NNI have no row, because there is no subscriber to graph.
The table is served over SNMP only. It is not included in the Prometheus scrape, because a series per subscriber would be too many series.