[mrtg] Re: Network Bandwidth

[James Davis]

Bigelow, Andrea L. wrote:

> Sure, but you have to know what you're looking for. You can't detect
> anything outside of a "norm" if you don't know what that norm is. Trace the
> bandwidth patterns over a period of time, preferably a month or two at
> least, and that will give you a good baseline, but find out from your boss
> how he defines 'norm'.

I do some similar monitoring not using mrtg but some perl scripts I've 
written, the principles are the same though. I work out the average, and 
standard deviation of the data for, say, the last 10 days. I then 
perform the same calculations for the data from the last hour. If the 
average for the smaller period differs from the larger one by more than 
two standard deviations I trigger an alert.

I've also set alerts to trigger if the average goes above a certain 
limit x, and have tried to extrapolate from some very naive trends if 
the average will rise above x in the next n days.

You can go into far more detail, these are only some quick, easy and 
basic checks that I perform. You could for example perform a comparison 
at 1100hrs of the last hours traffic with that of 1000-1100hrs on 
previous days. You could go on and on, deciding upon more things to 
measure, compare and check and end up with a huge number of checks.

It would probably best to decide upon what constitutes abnormal 
behavior, and how quickly you are supposed to detect it and define it 
clearly and precisely before puzzling over how to look for it.

Regards,

James

--
Unsubscribe mailto:mrtg-request at list.ee.ethz.ch?subject=unsubscribe
Archive     http://www.ee.ethz.ch/~slist/mrtg
FAQ         http://faq.mrtg.org    Homepage     http://www.mrtg.org
WebAdmin    http://www.ee.ethz.ch/~slist/lsg2.cgi