[mrtg] MRTG exact sampling interval

[Mustafa Abdel-Hady]

Dear all,
thanks a lot for your support, I really appreciate that.
This is a part of a MRTG file:
1256555400 357195 556989 552467 561736
1256555100 256331 554642 552467 556445
1256554800 145589 552803 189183 558581
1256554500 162299 554635 169795 556920
The difference between time stamps here is 5 min, but you can notice that there is a big difference between the average and maximum values, which may mean that there is a certain resolution that is lower than 5 minutes, or in other words, the MRTG can sense peak utilization values in an interval which is lower than 5 minutes or it has a polling interval to the devices less than 5 minutes.
Does that make sense?
And please I want to know this sampling interval.
Thanks a lot.
Best Regards,
Mustafa




-----Original Message-----
From: "Matthew Petach" [mpetach at yahoo.com]
Date: 12/24/2009 11:52 PM
To: "Mustafa" <maelhady at eventumsolutions.com>, mrtg at lists.oetiker.ch
Subject: Re: [mrtg] MRTG exact sampling interval




>
>From: Mustafa <maelhady at eventumsolutions.com>
>To: mrtg at lists.oetiker.ch
>Sent: Thu, December 24, 2009 11:45:03 AM
>Subject: [mrtg] MRTG exact sampling interval
>
> >
>
>
>>
>Dear all,
>Please I have a question, in the MRTG .log files
>there are 5 columns:
>1-     
> the first one is the time
>stamp in UTC 
>2-     
>the second one is the average
>incoming transfer rate in bytes per second. This is valid for the time between
>the UTC of the current line and the UTC of the previous line
>3-     
>the third column is same as the
>second but outgoing.
>4-     
>The fourth column is the maximum
>incoming transfer rate in bytes per second for the current interval. This is
>calculated from all the updates which have occurred in the current interval.
>5-     
>The fifth is the same as the
>fourth one but outgoing.
>So that means that there is some sampling time that is less than the
>specified interval in the "mrtg.cfg" file to be able to detect the
>maximum. For example, I have adjusted the interval to be 5 minutes and I got
>values in the .log file as the following:
>1251871200      124890    463933    204720
>   497123
>1251864000      124836
>   464014    188781    500925
>1251856800      153102
>   478951    705564    892407
>1251849600      129210
>   466166    185505    515786
>As the second column is the average over 5 minutes, and the 4th >column values is much greater than maximum values, so my question is exactly: what is the minimum interval that the MRTG can detect
>a certain maximum throughput within it?

The minimum interval  is 5 minutes for detecting throughput.

The section of the config file you have there shows data aggregated up into 2 hour
intervals (note there are 7200 seconds between each line).  Thus, column 2 is showing
the average *over two hours*, while column 4 is showing *the highest 5 minute value
recorded during that two hour interval*.  That's why the numbers are so different.

If you look at the first 600 lines of the config file, you'll note those are the 5 minute data
samples, and there, columns 2 and column 4 will be almost equal.  As the data gets
averaged more and more in subsequent sections of the file, the difference between
the average and peak values generally gets larger.

Hope this helps clarify what you're seeing.  :)

Matt

>Thanks a lot for your patience and your support, I really appreciate that.
>Best Regards,
> 
>MUSTAFA A. ABDEL
>HADY
>Network Engineer
> 
>