[mrtg] Re: mrtg log formula known, but don't understand it.
Robin.Butler at ioko.com
Mon Mar 8 16:09:29 MET 2004
Thanks for your reply. However, this does not solve my problem.
In reply to your email,
The device setting is automatically retrieved by cfgmaker from the
interface configured on the router.
The interface is correctly configured as a 256Kbps leased line.
The MaxBytes value was correctly set to 32000 for the 256kbps interface.
As you correctly pointed out the data would not be logged if the
MaxBytes parameter was exceeded. I therefore increased the MaxBytes to
allow the returned data to be logged to help diagnose the problem.
I have reset MaxBytes to its original value of 32000 and monitored the
logs as advised. Once again MaxBytes has been exceeded and no data
logged, except for the counter on the first line. I have included a
sample of a log.
1078737814 2324088909.00 4224596427.00
1078737814 0 0 0 0
1078737514 0 0 0 0
1078737300 0 0 0 0
1078737000 0 0 0 0
1078736700 0 0 0 0
After adding the AbsMax option to mrtg.cfg with a value of 32000000 data
was recorded once again. I've included a sample of the 1st line log
entries along with a sample of the log file allowing you to examine the
1st line counter entries from the log file (AbsMax set)
1078757813 2436009776.00 249898934.00
1078757513 2434881597.00 247306352.00
1078757213 2433410209.00 243925314.00
1078756913 2432225669.00 240334402.00
1078756613 2428532361.00 232031062.00
Log file with AbsMax set
1078757813 2436009776.00 249898934.00
1078757813 3760597 8641940 3760597 8641940
1078757513 4904627 11270127 4904627 11270127
1078757400 4544473 11533635 4904627 11969707
1078757100 7098364 17886422 12311027 27677800
1078756800 7673873 17252495 12311027 27677800
1078756500 0 0 0 0
1078756200 0 0 0 0
1078755900 0 0 0 0
1078755600 0 0 0 0
Once again, the only formula that seems to explain how the counter (1st
line log file entries) result in the log data is as follows:
((current inbytes - previous inbytes) / (current time - previous time))
* 1000) = inbytes AVG
But the data still seems to be multiplied by 1000. I must be doing
something fundamentally wrong?
Firewall and Network Engineer
Tel: 01904 438000
Mob: 07776 198142
Fax: 01904 435450
Email: robin.butler at ioko.com
From: Alex van den Bogaerdt [mailto:alex at ergens.op.het.net]
Sent: 05 March 2004 12:13
To: mrtg at list.ee.ethz.ch
Subject: [mrtg] Re: mrtg log formula known, but don't understand it.
On Fri, Mar 05, 2004 at 11:40:35AM -0000, Robin Butler wrote:
> I am trying to configure MRTG to monitor a number of routers and
> switches but so far I have encountered some problems.
> This problem seems to be caused when MRTG is processing data for its
> entry, it multiplies the data by 1000 which causes the entry to exceed
> the maximum bandwidth for a given interface and is therefore discarded
> by the MRTG logs.
> I understand the format of the MRTG log files is as follows:
> First line: <UNIX_time_in_seconds_since_epoch>
> <current_input_value_in_bytes> <current_output_value_in_bytes>
I prefer: <time> <inbytes> <outbytes>
> Data: < UNIX_time_in_seconds_since_epoch>
> <input_during_time_interval_in_bytes> <input_average_in_bytes>
> <output_during_time_interval_in_bytes> <output_average_in_bytes>
It is: <time> <inb AVG> <inb MAX> <outb AVG> <outb MAX>
> Initially no data was being recorded in the logs.
> After debugging MRTG I understand this was caused by the amount of
> (input and output) exceeding the MaxBytes option. This option was
> correctly configured by cfgmaker for the interface bandwidth.
This was copied from the device. If the device has this setting wrong,
so will cfgmaker.
> I understand that MRTG (cfgmaker) calculates MaxBytes as follows:
> Interface speed 256Kbps (Kilo bits)
> 256 / 8 = 32KBps (Kilo Bytes)
> 32 * 1000 = 32000 B/s (Bytes per second)
> MaxBytes = 32000
> However, data logged by MRTG seems to massively exceed this threshold.
It is logged, or it is not. If it would exceed maxbytes, it would not
> On further analysis, the following equation seems to be used by MRTG
> calculate a log entry.
> ((current_input_value_in_bytes - previous_input_value_in_bytes) /
> time_interval) * 1K) = data entry
No. <current_time - previous_time> / <current_val - previous_val>
> Most of which makes sense except the last multiplication. Why multiply
> the data by 1000 when it is already in Bps?
MRTG does not do this. It may be possible you tell MRTG to alter
the value it gets from the device. The altered value goes in above
> My mrtg.cfg test config file is as follows:
> Interval: 5
> WorkDir: /mrtg-test
> Options[_]: bits,nobanner,growright
> Target[22.214.171.124_3]: 3:COMSTR at 126.96.36.199:
> SetEnv[188.8.131.52_3]: MRTG_INT_IP="184.108.40.206" MRTG_INT_DESCR="Serial3/0"
> #MaxBytes[220.127.116.11_3]: 32000
> MaxBytes[18.104.22.168_3]: 32000000
> Title[22.214.171.124_3]: Traffic Analysis for 3 - host.domain.com
Do the following:
Watch the log file closely. Wait until it is updated. Copy the
first line of this file and wait. After the next update, copy the
first line again. Do the math. Repeat a few times.
Outcome: the increase of the counters, in bytes, per second.
Compare to maxbytes.
Unsubscribe mailto:mrtg-request at list.ee.ethz.ch?subject=unsubscribe
FAQ http://faq.mrtg.org Homepage http://www.mrtg.org
More information about the mrtg