[mrtg] Re: Log Aggregation

[PAUL WILLIAMSON]

You are correct sir, kinda.

I think the 2 hour values are actually taken from the 24 previous 
5 minute readings, not the 4 30 minute averages.  I'm sure I'll 
be corrected if I'm wrong.

It may not _display_ that value, but it is in the log file.

Paul

>>> "James Amann" <jamann at gsu.edu> 07/02/03 11:21AM >>>
Right, but MRTG does NOT average the MAX value at any juncture correct?


eg:

5 min value = 100%

30 min values = 01% , 01% ,01% ,01% ,01% ,100%  :  Max for that 30min
is still 100%

2hr values = 01%, 01%, 01%, 100%  :  Max for 30min is still 100%

etc.

James

>>> "PAUL WILLIAMSON" <pwilliamson at mandtbank.com> 07/02/03 11:09AM >>>
The value polled in a 5 minute period is just that - the value.

In itself it is not a max, but compared to the other 5 values in that
30 
minute period, one of them will be the max value.

Remember that if there is a gigantic spike at the beginning of the 5
minute 
slice, but virtually no traffic the rest of the time, the traffic will
look the 
same as if there had been a constant rate of data during another slice

where the amount of data passed is the same.

I'm experiencing an issue now where our links will spike up to 20 mb/s

for a 10 second span, then drop to nothing.  People have started 
to look at why our network is so "bursty" but unless I poll more often

than 5 minutes, MRTG will not be able to help with pinpointing the 
amount of traffic withing a small timeframe (like polling ever 10
seconds 
or something crazy).

Paul


>>> "James Amann" <jamann at gsu.edu> 07/02/03 10:33AM >>>
>From the docs, the logs aggregate data,

5min

1/2 hr

2 hr

1 day

I am trying to confirm that the MAX values are never averaged. 
Meaning
if I recive a value that is the max for a 5 min period, when
aggregated
into the 1/2 hr period, if it is still the max value of the other 5
min
slices for the 1/2 hour, it will still be the max, and so on.

I have looked through the docs and cannot confirm from what I found,
and I have always assumed that the maximum value would propogate to
the
last aggregation at 1 day without any averaging, but we are seeing
something in our logs that forces me to ask the question.

Thanks in advance for any assistance and or confirmation anyone can
provide.  Thank you.

James Amann

--
Unsubscribe mailto:mrtg-request at list.ee.ethz.ch?subject=unsubscribe 
Archive     http://www.ee.ethz.ch/~slist/mrtg 
FAQ         http://faq.mrtg.org    Homepage     http://www.mrtg.org 
WebAdmin    http://www.ee.ethz.ch/~slist/lsg2.cgi 

--
Unsubscribe mailto:mrtg-request at list.ee.ethz.ch?subject=unsubscribe 
Archive     http://www.ee.ethz.ch/~slist/mrtg 
FAQ         http://faq.mrtg.org    Homepage     http://www.mrtg.org 
WebAdmin    http://www.ee.ethz.ch/~slist/lsg2.cgi 


--
Unsubscribe mailto:mrtg-request at list.ee.ethz.ch?subject=unsubscribe
Archive     http://www.ee.ethz.ch/~slist/mrtg
FAQ         http://faq.mrtg.org    Homepage     http://www.mrtg.org
WebAdmin    http://www.ee.ethz.ch/~slist/lsg2.cgi