Hi Steelbule,
By default, the device collects statistics on six sampling points every 300 seconds. So 50 seconds will calculate the rate once. The average rate in the last 300 seconds is calculated. Then divide the average rate by the bandwidth to calculate the bandwidth usage. and compare the bandwidth usage with the threshold to determine whether to report an alarm.
If the traffic surges in a very short time, the calculated bandwidth usage may not be high because the average rate of 300s is used.
The default 300s can be adjusted using the set flow-stat interval command. The minimum value is 10s. After the adjustment, six sampling points are collected within the interval and the average rate is calculated.
[Router-GigabitEthernet2/0/2]set flow-stat interval ?
INTEGER<10-600> The value of time interval (second) of interface flow statistics. It must be a multiple of 10, default is 300.
Note:
If the interval is too short, the CPU usage will be high.
Any further questions, let us know!