Network & Infrastructure / Telemetry, Capacity & Incident Analysis
Counter resets and false traffic spikes in network dashboards
An interface restart produces a huge bandwidth spike on a dashboard even though traffic was low. The query may be treating a cumulative counter as a gauge or mishandling a reset.
Environment and inputs: Network and infrastructure observability; Prometheus examples describe metric semantics rather than a universal exporter schema. Diagnostic/design example; not tested on production equipment.
Collect the evidence
Record metric type, raw samples, restart time, scrape interval and exporter behavior. Check whether the source is a narrow device counter that can wrap or a reset-aware exported counter.
Explain the result
Cumulative counters require rate calculations that account for their lifecycle. Subtracting values without reset handling can create negative rates or impossible positive utilization after a discontinuity.
Plan the fix
Use the monitoring system's documented counter functions and preserve meaningful interface identity. Review aggregation order so resets are detected before unrelated series are combined.
Check the result and rollback
Replay or inspect a known restart and compare computed rates with independent traffic evidence. Revert the query if it hides real bursts or joins counters from different interface lifetimes.