[mrtg] Re: Removing a "blip"?

[Alex van den Bogaerdt]

> 	We ran into a networking problem recently that blasted 39Mbs
> to every since port on every single switch.  As such, every graph currently
> shows a tremendous spike, and anything else thats normally usable is gone.
> 
> 	I'm wondering if there is some utility or something that I can
> run saying "From 2-3PM today, pretend the switch was unreachable and
> adjust everything accordingly".  I was told I could hand edit the log,
> delete the old, and it would re-calc everything.  I have alot to do this
> to and wondered if there was something I can do programatically?
> 

If you want to stick to the old mrtg with rateup, there are a few things
you could do:

1) Write a script that parses the logfiles and alters the high values.
   This could be as simple as the following awk script but you better
   check it and add some error handling:
   
   <mrtg.log awk '{
          if ($2>6000) $2=6000
          if ($3>6000) $3=6000
          if ($4>6000) $4=6000
          if ($5>6000) $5=6000
          print
      }' >mrtg.newlog && mv mrtg.newlog mrtg.log

   If you really would like to pretend an unreachable switch, you need
   to copy the previous value (which is the next line).  I leave this
   as an exercise for the reader :)

2) Write an external program that does the snmpget.  Check the values
   and return them only when below a certain value.  This won't alter
   your current values but it helps in the future.

3) Set maxbytes and absmax.  This will prevent the high values from
   entering your logs but has the disadvantage that your percentages
   are wrong.

IMHO you'd better change to mrtg and rrdtool.  This way, you don't
care about the blips and you just write the script so that it will
only show the relevant part of the graph.  Start by using 14all.cgi
and when you understand rrdtool a little more, write your own script.
Suppose you would like to know the real throughput too?  No problem,
another script which doesn't limit the Y-axis and voila, it's there.
-- 
   __________________________________________________________________
 / alex at slot.hollandcasino.nl                  alex at ergens.op.het.net \
| work                                                         private |
| My employer is capable of speaking therefore I speak only for myself |
+----------------------------------------------------------------------+

--
* To unsubscribe from the mrtg mailing list, send a message with the
  subject: unsubscribe to mrtg-request at list.ee.ethz.ch
* The mailing list archive is at http://www.ee.ethz.ch/~slist/mrtg