<html><head><meta http-equiv="Content-Type" content="text/html charset=gb18030"><base href="x-msg://466/"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">The OIDs for those two graphs are:<div><br></div><div>New Connections: sysStatClientTotConns.0&sysStatServerTotConns.0:public@<<IP Address Here>>:::::2</div><div><br></div><div>Established Connections: sysStatClientCurConns.0&sysStatServerCurConns.0:public@<<IP Address Here>>:::::2</div><div><br></div><div>Other ones I am graphing are:</div><div><br></div><div>Client Traffic: sysStatClientBytesOut.0&sysStatClientBytesIn.0:public@<<IP Address Here>>:::::2</div><div>Server Traffic: sysStatServerBytesIn.0&sysStatServerBytesOut.0:public@<<IP Address Here>>:::::2</div><div>HTTP Requests: sysStatHttpRequests.0&sysStatHttpRequests.0:public@<<IP Address Here>>:::::2</div><div>RAM in Use: ( sysStatMemoryUsed.0&sysStatMemoryUsed.0:public@<<IP Address Here>>:::::2 / sysStatMemoryTotal.0&sysStatMemoryTotal.0:public@<<IP Address Here>>:::::2 ) * 100</div><div><br></div><div>I solved the discontinuity at midnight issue. SNMP and MRTG are correct - the drop in traffic right at midnight is real. There is nothing in the F5 that is responsible for this. There are policies on the servers that cause certain traffic to be reset at midnight.</div><div><br></div><div>- Matt</div><div><br></div><div><br></div><div><div><div>On Dec 19, 2012, at 6:50 PM, Steve Shipway <<a href="mailto:s.shipway@auckland.ac.nz">s.shipway@auckland.ac.nz</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div lang="EN-NZ" link="blue" vlink="purple" style="font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; "><div class="WordSection1" style="page: WordSection1; "><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: SimSun; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); ">What are the two OIDs you are graphing? I assume one of them is the global total connections... a suitable-sanitised snippet of your cfg file would be helpful here.<o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: SimSun; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); "> </span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: SimSun; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); ">I¡¯m particularly interested in this as Im in the process of fully monitoring our F5 ¨C I have created a plugin for Nagios and MRTG to pull out not only this data, but also other performance and health data on a global, cluster or per-VIP basis, and am keen to avoid any potential problems (if you want a copy of the beta plugin, it is available on<span class="Apple-converted-space"> </span><a href="http://www.nagiosexchange.org" style="color: purple; text-decoration: underline; ">www.nagiosexchange.org</a>)<o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: SimSun; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); "> </span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: SimSun; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); ">A collection of the raw data might help (to see if there really IS a sudden dropoff in connection rate at midnight); also your own knowledge of how the F5 is being used and by what might let you find out about changes in usage patterns at midnight, or any scheduled tasks or resets you have in client machines at that time. I can¡¯t help you with that of course.<o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: SimSun; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); "> </span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: SimSun; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); ">We run several F5s in multiple clusters and have not observed this sort behaviour either singly or as a cluster, except when a cluster fails over to the other F5 member. For this reason, I suspect the data are valid, and caused by some other even on your network or application servers.<o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: SimSun; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); "> </span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: SimSun; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); ">Steve <o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: SimSun; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); "> </span></div><div><div class="MsoNormal" align="center" style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: SimSun; text-align: center; "><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); "></span></div></div></div></div></blockquote></div><br></div></body></html>