[mrtg] Re: mrtg log formula known, but don't understand it.

[Alex van den Bogaerdt]

On Fri, Mar 05, 2004 at 11:40:35AM -0000, Robin Butler wrote:
> Hello,
> 
> I am trying to configure MRTG to monitor a number of routers and
> switches but so far I have encountered some problems.
> 
> This problem seems to be caused when MRTG is processing data for its log
> entry, it multiplies the data by 1000 which causes the entry to exceed
> the maximum bandwidth for a given interface and is therefore discarded
> by the MRTG logs.
> 
> I understand the format of the MRTG log files is as follows:
> 
> First line:           <UNIX_time_in_seconds_since_epoch>
> <current_input_value_in_bytes> <current_output_value_in_bytes>

correct.
I prefer:  <time> <inbytes> <outbytes>

> Data:                < UNIX_time_in_seconds_since_epoch>
> <input_during_time_interval_in_bytes> <input_average_in_bytes>
> <output_during_time_interval_in_bytes> <output_average_in_bytes>

Wrong.
It is:  <time> <inb AVG> <inb MAX> <outb AVG> <outb MAX>

> Initially no data was being recorded in the logs.
> 
> After debugging MRTG I understand this was caused by the amount of data
> (input and output) exceeding the MaxBytes option. This option was
> correctly configured by cfgmaker for the interface bandwidth. 

This was copied from the device.  If the device has this setting wrong,
so will cfgmaker.

> I understand that MRTG (cfgmaker) calculates MaxBytes as follows:
> 
> Interface speed 256Kbps            (Kilo bits) 
> 
> 256 / 8 = 32KBps                       (Kilo Bytes)
> 
> 32 * 1000 = 32000 B/s                (Bytes per second)
> 
> MaxBytes = 32000

correct

> However, data logged by MRTG seems to massively exceed this threshold.

It is logged, or it is not.  If it would exceed maxbytes, it would not
be logged.

> On further analysis, the following equation seems to be used by MRTG to
> calculate a log entry. 
>  
> 
> ((current_input_value_in_bytes - previous_input_value_in_bytes) /
> time_interval) * 1K) = data entry

No.  <current_time - previous_time> / <current_val - previous_val>

> Most of which makes sense except the last multiplication. Why multiply
> the data by 1000 when it is already in Bps?

MRTG does not do this.  It may be possible you tell MRTG to alter
the value it gets from the device.  The altered value goes in above
calculation.

> My mrtg.cfg test config file is as follows:
> 
> RunAsDaemon:Yes
> Interval: 5
> WorkDir: /mrtg-test
> Options[_]: bits,nobanner,growright
> 
> Target[1.2.3.4_3]: 3:COMSTR at 1.2.3.4:
> SetEnv[1.2.3.4_3]: MRTG_INT_IP="5.6.7.8" MRTG_INT_DESCR="Serial3/0"
> #MaxBytes[1.2.3.4_3]: 32000
> MaxBytes[1.2.3.4_3]: 32000000
> Title[1.2.3.4_3]: Traffic Analysis for 3 - host.domain.com


Do the following:

Watch the log file closely.  Wait until it is updated.  Copy the
first line of this file and wait.  After the next update, copy the
first line again. Do the math.  Repeat a few times.

Outcome: the increase of the counters, in bytes, per second.

Compare to maxbytes.

-- 
begin  sig
http://www.googlism.com/index.htm?ism=alex+van+den+bogaerdt&type=1
This message was produced without any <iframe tags

--
Unsubscribe mailto:mrtg-request at list.ee.ethz.ch?subject=unsubscribe
Archive     http://www.ee.ethz.ch/~slist/mrtg
FAQ         http://faq.mrtg.org    Homepage     http://www.mrtg.org
WebAdmin    http://www.ee.ethz.ch/~slist/lsg2.cgi