[mrtg] MRTG exact sampling interval

[Lyle Giese]

Matthew Petach wrote:
>
>   
>> From: Mustafa <maelhady at eventumsolutions.com>
>> To: mrtg at lists.oetiker.ch
>> Sent: Thu, December 24, 2009 11:45:03 AM
>> Subject: [mrtg] MRTG exact sampling interval
>>
>>     
>>     
>> Dear all,
>> Please I have a question, in the MRTG .log files
>> there are 5 columns:
>> 1-     
>> the first one is the time
>> stamp in UTC 
>> 2-     
>> the second one is the average
>> incoming transfer rate in bytes per second. This is valid for the time between
>> the UTC of the current line and the UTC of the previous line
>> 3-     
>> the third column is same as the
>> second but outgoing.
>> 4-     
>> The fourth column is the maximum
>> incoming transfer rate in bytes per second for the current interval. This is
>> calculated from all the updates which have occurred in the current interval.
>> 5-     
>> The fifth is the same as the
>> fourth one but outgoing.
>> So that means that there is some sampling time that is less than the
>> specified interval in the "mrtg.cfg" file to be able to detect the
>> maximum. For example, I have adjusted the interval to be 5 minutes and I got
>> values in the .log file as the following:
>> 1251871200      124890    463933    204720
>>   497123
>> 1251864000      124836
>>   464014    188781    500925
>> 1251856800      153102
>>   478951    705564    892407
>> 1251849600      129210
>>   466166    185505    515786
>> As the second column is the average over 5 minutes, and the 4th >column values is much greater than maximum values, so my question is exactly: what is the minimum interval that the MRTG can detect
>> a certain maximum throughput within it?
>>     
>
> The minimum interval  is 5 minutes for detecting throughput.
>
> The section of the config file you have there shows data aggregated up into 2 hour
> intervals (note there are 7200 seconds between each line).  Thus, column 2 is showing
> the average *over two hours*, while column 4 is showing *the highest 5 minute value
> recorded during that two hour interval*.  That's why the numbers are so different.
>
> If you look at the first 600 lines of the config file, you'll note those are the 5 minute data
> samples, and there, columns 2 and column 4 will be almost equal.  As the data gets
> averaged more and more in subsequent sections of the file, the difference between
> the average and peak values generally gets larger.
>
> Hope this helps clarify what you're seeing.  :)
>
> Matt
>
>   
>> Thanks a lot for your patience and your support, I really appreciate that.
>> Best Regards,
>>
>> MUSTAFA A. ABDEL
>> HADY
>> Network Engineer
>>
>>
>>     

To further explain some of this, you are using MRTG in it's native
logging form and not using rrd databases. Because of the way MRTG is
programmed when using native logging and rateup, it does heavily depend
on a 5 minute polling interval. You need to try to poll every 5 minutes
to get accurate data and averaging from your devices.

When you convert to rrd databases, you can poll more often and the front
end(I recommend routers2.cgi) can be fine tuned. But the basis of all
development was built around the 5 minute polling interval, so unless
you have a real serious desire to poll more often, don't. And the cpu
load in rrd mode is way less than using the native logging within MRTG.

Lyle Giese
LCR Computer Services, Inc.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.oetiker.ch/pipermail/mrtg/attachments/20091224/fba77f13/attachment-0001.htm