RMON Absolute VS Delta

RMON can be used to monitor certain SNMP MIBs and generate an event for a certain threshold. One of the things you have to do when configuring RMON is choosing between absolute or delta sampling. In short, this is the difference between the two:

• Delta: values that always constantly increase OR constantly decrease.
• Absolute: values that can increase or decrease.

Delta should be used for values that will always increase or decrease (one of the two), for example interface counters like the number of input errors, CRC errors, output packets, interface resets etc. These are values that will always increase unless you reset the interface counters. I can’t think of any counters on a Cisco router or switch that always decrease.

Absolute should be used for values that increase or decrease over a certain amount of time, a good example is CPU usage. You probably want to receive a notification each time when your CPU load hits a certain threshold (like 85%) and receive a notification when it goes below another threshold (10% or so), this is absolute sampling.

Another example of absolute sampling could be the input or output rate of an interface as this can increase or decrease over the span of time. At one moment it might be 10.000 bits/sec, 10 minutes later it could be 5.000 bits/sec and 45 minutes later it might be 20.000 bits/sec.

I hope this helps to understand the difference between the two. If you need some more examples just leave a comment.