[mrtg] Re: mrtg log formula known, but don't understand it.

Mon Mar 8 16:09:29 MET 2004

Thanks for your reply. However, this does not solve my problem.

In reply to your email,

The device setting is automatically retrieved by cfgmaker from the
interface configured on the router. 

The interface is correctly configured as a 256Kbps leased line.

The MaxBytes value was correctly set to 32000 for the 256kbps interface.
As you correctly pointed out the data would not be logged if the
MaxBytes parameter was exceeded. I therefore increased the MaxBytes to
allow the returned data to be logged to help diagnose the problem.

I have reset MaxBytes to its original value of 32000 and monitored the
logs as advised. Once again MaxBytes has been exceeded and no data
logged, except for the counter on the first line. I have included a
sample of a log. 

1078737814 2324088909.00 4224596427.00

1078737814 0 0 0 0

1078737514 0 0 0 0

1078737300 0 0 0 0

1078737000 0 0 0 0

1078736700 0 0 0 0

After adding the AbsMax option to mrtg.cfg with a value of 32000000 data
was recorded once again. I've included a sample of the 1st line log
entries along with a sample of the log file allowing you to examine the
data.

1st line counter entries from the log file (AbsMax set)

1078757813 2436009776.00 249898934.00

1078757513 2434881597.00 247306352.00

1078757213 2433410209.00 243925314.00

1078756913 2432225669.00 240334402.00

1078756613 2428532361.00 232031062.00

Log file with AbsMax set

1078757813 2436009776.00 249898934.00

1078757813 3760597 8641940 3760597 8641940

1078757513 4904627 11270127 4904627 11270127

1078757400 4544473 11533635 4904627 11969707

1078757100 7098364 17886422 12311027 27677800

1078756800 7673873 17252495 12311027 27677800

1078756500 0 0 0 0

1078756200 0 0 0 0

1078755900 0 0 0 0

1078755600 0 0 0 0

Once again, the only formula that seems to explain how the counter (1st
line log file entries) result in the log data is as follows:

((current inbytes - previous inbytes) / (current time - previous time))
* 1000) = inbytes AVG

But the data still seems to be multiplied by 1000. I must be doing
something fundamentally wrong?

Thanks,

Robin.

Robin Butler

Firewall and Network Engineer

ioko

Tel: 01904 438000

Mob: 07776 198142

Fax: 01904 435450

Email: robin.butler at ioko.com

-----Original Message-----
From: Alex van den Bogaerdt [mailto:alex at ergens.op.het.net] 
Sent: 05 March 2004 12:13
To: mrtg at list.ee.ethz.ch
Subject: [mrtg] Re: mrtg log formula known, but don't understand it.

On Fri, Mar 05, 2004 at 11:40:35AM -0000, Robin Butler wrote:

> Hello,

> 

> I am trying to configure MRTG to monitor a number of routers and

> switches but so far I have encountered some problems.

> 

> This problem seems to be caused when MRTG is processing data for its
log

> entry, it multiplies the data by 1000 which causes the entry to exceed

> the maximum bandwidth for a given interface and is therefore discarded

> by the MRTG logs.

> 

> I understand the format of the MRTG log files is as follows:

> 

> First line:           <UNIX_time_in_seconds_since_epoch>

> <current_input_value_in_bytes> <current_output_value_in_bytes>

correct.

I prefer:  <time> <inbytes> <outbytes>

> Data:                < UNIX_time_in_seconds_since_epoch>

> <input_during_time_interval_in_bytes> <input_average_in_bytes>

> <output_during_time_interval_in_bytes> <output_average_in_bytes>

Wrong.

It is:  <time> <inb AVG> <inb MAX> <outb AVG> <outb MAX>

> Initially no data was being recorded in the logs.

> 

> After debugging MRTG I understand this was caused by the amount of
data

> (input and output) exceeding the MaxBytes option. This option was

> correctly configured by cfgmaker for the interface bandwidth. 

This was copied from the device.  If the device has this setting wrong,

so will cfgmaker.

> I understand that MRTG (cfgmaker) calculates MaxBytes as follows:

> 

> Interface speed 256Kbps            (Kilo bits) 

> 

> 256 / 8 = 32KBps                       (Kilo Bytes)

> 

> 32 * 1000 = 32000 B/s                (Bytes per second)

> 

> MaxBytes = 32000

correct

> However, data logged by MRTG seems to massively exceed this threshold.

It is logged, or it is not.  If it would exceed maxbytes, it would not

be logged.

> On further analysis, the following equation seems to be used by MRTG
to

> calculate a log entry. 

>  

> 

> ((current_input_value_in_bytes - previous_input_value_in_bytes) /

> time_interval) * 1K) = data entry

No.  <current_time - previous_time> / <current_val - previous_val>

> Most of which makes sense except the last multiplication. Why multiply

> the data by 1000 when it is already in Bps?

MRTG does not do this.  It may be possible you tell MRTG to alter

the value it gets from the device.  The altered value goes in above

calculation.

> My mrtg.cfg test config file is as follows:

> 

> RunAsDaemon:Yes

> Interval: 5

> WorkDir: /mrtg-test

> Options[_]: bits,nobanner,growright

> 

> Target[1.2.3.4_3]: 3:COMSTR at 1.2.3.4:

> SetEnv[1.2.3.4_3]: MRTG_INT_IP="5.6.7.8" MRTG_INT_DESCR="Serial3/0"

> #MaxBytes[1.2.3.4_3]: 32000

> MaxBytes[1.2.3.4_3]: 32000000

> Title[1.2.3.4_3]: Traffic Analysis for 3 - host.domain.com

Do the following:

Watch the log file closely.  Wait until it is updated.  Copy the

first line of this file and wait.  After the next update, copy the

first line again. Do the math.  Repeat a few times.

Outcome: the increase of the counters, in bytes, per second.

Compare to maxbytes.

-- 

--
Unsubscribe mailto:mrtg-request at list.ee.ethz.ch?subject=unsubscribe
Archive     http://www.ee.ethz.ch/~slist/mrtg
FAQ         http://faq.mrtg.org    Homepage     http://www.mrtg.org
WebAdmin    http://www.ee.ethz.ch/~slist/lsg2.cgi