[mrtg] Re: Manually Editing Log Files

[Alex van den Bogaerdt]

Scheidel, Greg wrote:
> 
> Can anyone out there provide more detail or hints on the *.log files,
> specifically:
> 
> - What you might want to watch out for if you have to manually edit them?

The logfiles are in a specific format.  You must keep that format.

> - Exactly how the "incoming bytes counter" and "outgoing bytes counter" are
> generated.  Again this is needed so that I can generate correct counter
> values after manually editing the log files.
> 
Every five minutes, MRTG collects the counters.  It passes them to rateup
and this process will modify the *.log file.  It does so by calculating
the differences in both time and counters (available on line one).  We
use the term "delta".  The counter delta is divided by the time delta.
This is the rate.  This rate is stored.  The maximum rate seen is also
stored (this differs from the average rate).
If the time stamps are not on exact five-minute intervals, rateup will
recalculate the numbers and make sure it does store them on five minute
intervals.

Another task of rateup is to calculate weekly, monthly and yearly averages
from the daily averages.  It does so at specific intervals.


> The reason for these questions is that our MRTG system has been continuously
> monitoring interfaces by IF #s on several routers that have had the IF #s
> changed due to router configuration changes.  I need to concatenate (the
> data *before* the change from one log file) to (the data *after* the change
> from another log file), making sure that the "incoming bytes counter" and
> "outgoing bytes counter" are correct and that MRTG accepts the new log data.
> 

First of all: backup your *.log and *.old files.

Example when two interfaces changed place:

mrtga.log and mrtgb.log are correct for most of the values.  On december
14, 12:34:56 the interface numbers swapped.  This means that the first few
log entries are wrong.  The first sample taken after the change has occured
is wrong and you can't do very much about that.  All other samples are correct
as they use the new (swapped) counters.

If you have both logfiles, you do have most of the correct values.  Make sure
that both files are processed at the same time (you can do this now) so that
the time stamps are the same.  Then stop updating the files.

Find out which time the change occured, calculate the correct unix time stamp.
This is possible using GNU date (date -d '12:34:56 dec 12 1999' +%s).

Split both log files at that time and paste the correct parts together.

Regards,
-- 
   __________________________________________________________________
 / alex at slot.hollandcasino.nl                  alex at ergens.op.het.net \
| work                                                         private |
| My employer is capable of speaking therefore I speak only for myself |
+----------------------------------------------------------------------+

--
Unsubscribe mailto:mrtg-request at list.ee.ethz.ch?subject=unsubscribe
Help        mailto:mrtg-request at list.ee.ethz.ch?subject=help
Archive     http://www.ee.ethz.ch/~slist/mrtg