[rrd-users] Large-interval data is not displaying as I expected

[Herminio Gonzalez]

I'm quite new to rrdtool, though have managed to set up a number or
useful graphs, thanks to the excellent documentation out there.

But this time I am stumped. I want to produce a chart showing how many
hosts have been added to a deny-list by DenyHosts. The data comes from
simply counting the lines in a continuously growing text file of IP
addresses.

This is how I created the rrd database:

rrdtool create denyhosts.rrd --step 86400 \
DS:hostcount:COUNTER:172800:0:U \
RRA:LAST:0:1:2000

The step size of 86400 is one day.

This is my update script:

#!/bin/sh
HOSTCOUNT=`wc -l < /etc/hosts.deniedssh`
/usr/local/bin/rrdupdate ~/rrd/denyhosts.rrd N:`echo $HOSTCOUNT`

I run the update at one minute past midnight ever day.

After a few days of this I fetched some data.

 >rrdtool fetch denyhosts.rrd LAST --end now --start now-5d
1234915200: 2.3148094794e-05
1235001600: 1.8816128677e-05
1235088000: 1.5906185443e-05
1235174400: 2.3148080598e-05
1235260800: nan
1235347200: nan

It is not what I expected.

2.314e-05 multiplied by 86400 is close enough to 2, which is correct.

But 1.5906e-05 multiplied by 86400 is 1.374... which doesn't make any
sense. It should be 2 again for that day.

Plotting the results confirms the fetched data:
http://myhabitat.net/~hermi/rrd/denyhosts-problem.png
Only some of the data points line up with 1.0, 2.0, 3.0 integer boundaries.

-Herminio