Why are network counters only updated once a second?

I had mentioned this in my previous post but perhaps it might get more attention all by itself. I can't say for sure when this changed, but for the longest time network counters were only updated once every 0.9765 seconds and unless you used a tools like collectl that could monitor at fractional intervals, your traffic was under-reported AND you'd get periodic spikes of double the actual rate. See http://collectl.sourceforge.net/NetworkStats.html for a more complete explanation.

Eventually the frequency became better aligned at a 1 second interval because now the number look better, but the problem I see is that when the sampling interval is very close to the monitoring interval you still get periodic incorrect data. Furthermore, you now need to know which way the counters are updated before you pick a sampling interval! But the real point is if anyone ever wants to do finer grained monitoring, say every 1/2 or even tenth of a second, they can't because the counters won't change between samples. Has this ever been discussed before?

Quoted 4 lines · Mark Seger

I had mentioned this in my previous post but perhaps it might get more attention all by itself. I can't say for sure when this changed, but for the longest time network counters were only updated once every 0.9765 seconds and unless you used a tools like collectl that could monitor at fractional intervals, your traffic was under-reported AND you'd get periodic spikes of double the actual rate. See http://collectl.sourceforge.net/NetworkStats.html for a more complete explanation.

Eventually the frequency became better aligned at a 1 second interval because now the number look better, but the problem I see is that when the sampling interval is very close to the monitoring interval you still get periodic incorrect data. Furthermore, you now need to know which way the counters are updated before you pick a sampling interval! But the real point is if anyone ever wants to do finer grained monitoring, say every 1/2 or even tenth of a second, they can't because the counters won't change between samples. Has this ever been discussed before?

Yes it was discussed before. Some devices perform counters updates directly at the NIC level, and one in a while a transfert of counters is done to the host.

This is supposed to be better, especially on SMP.

Maybe you need to setup accounting rules with iptables, so that you can perform counter sampling at whatever rate you want ?

Eventually the frequency became better aligned at a 1 second interval because now the number look better, but the problem I see is that when the sampling interval is very close to the monitoring interval you still get periodic incorrect data. Furthermore, you now need to know which way the counters are updated before you pick a sampling interval! But the real point is if anyone ever wants to do finer grained monitoring, say every 1/2 or even tenth of a second, they can't because the counters won't change between samples. Has this ever been discussed before?