[mrtg] Re: log file format

[Alex van den Bogaerdt]

On Tue, Oct 22, 2002 at 05:19:08PM -0400, Mitchell K. Smith wrote:

> This is the log file for this interface at the same moment:
> 7206-inet.ems.net_hs1_0.log
> 1035319516 3949071763 1414454502
> 1035319516 119757 32410 119757 32410
> 1035319215 218534 67324 218534 67324
> 1035319200 208189 65196 218534 67324
> 1035318900 56503 35069 79626 58844
> 
> According to the log file format documentation,
> D (4th column)
> The maximum incoming transfer rate in bytes per second for the current interval. This is calculated from all the updates which have occurred in the current interval. If the current interval is 1 hour, and updates have occurred every 5 minutes, it will be the biggest 5 minute transfer rate seen during the hour. 
> 
> E (5th column)
> The maximum outgoing transfer rate in bytes per second for the current interval. 
> 
> Can someone explain the math for this.


Start of log file: each line describes 5 minutes.  Somewhere around
line 603 and the next 599 lines, each line describes 30 minutes.
Next 600 lines describe 2 hours each, remaining 732 lines describe
1 day each.

Column 1 is a time stamp.  Line 1 is the current situation (at the
time MRTG ran).  All the other numbers are normalized rates (search
for this on faq.mrtg.org).

In order to produce a 30-minute average or maximum, rateup uses 6
5-minute values. 

The average rate during 30 minutes is the same as the averages of
the 6 5-minute rates.  The maximum rate during 30 minutes is the
maximum of 6 5-minute rates.

if the numbers show:

t1     10   20    15   20
t2     15   20    15   20
t3      0    0     0    0
t4     15   20    20   20
t5      0   20     0   20
t6     10   10    10   10

where t1 means "interval from t1-300 to t1"   [1]
t2 means "interval from t2-300 to t2"
and so on

then rateup will consolidate this into one entry:

t6     a     b     c    d

where t6 means "interval from t6-1800 to t6"
a is avg(10,15,0,15,0,10)
b is avg(20,20,0,20,20,10)
c is max(15,15,0,20,0,10)
d is max(20,20,0,20,20,10)


Averages are used to calculate bytes transfered.  Maxima are used to
view the peak rates.

The average "a" multiplied by 1800 should equal approximately the sum
of 10*300, 15*300, 0*300, 15*300, 0*300, 10*300.

Clear enough?
Alex

[1] I could be wrong on this.  It could also mean "from t1 to t1+300".
    In that case, the resulting 30-minute interval will be shown at t1,
    not at t6.

--
Unsubscribe mailto:mrtg-request at list.ee.ethz.ch?subject=unsubscribe
Archive     http://www.ee.ethz.ch/~slist/mrtg
FAQ         http://faq.mrtg.org    Homepage     http://www.mrtg.org
WebAdmin    http://www.ee.ethz.ch/~slist/lsg2.cgi