[mrtg] Fwd: Re: MRTG exact sampling interval

[Alex van den Bogaerdt]

----- Original Message ----- 
From: "Mustafa Abdel-Hady" <maelhady at eventumsolutions.com>
To: <mrtg at lists.oetiker.ch>
Sent: Monday, December 28, 2009 2:41 PM
Subject: [mrtg] Fwd: Re: MRTG exact sampling interval


> Dear all,
> thanks a lot for your support, I really appreciate that.
> This is a part of a MRTG file:
> 1256555400 357195 556989 552467 561736
> 1256555100 256331 554642 552467 556445
> 1256554800 145589 552803 189183 558581
> 1256554500 162299 554635 169795 556920
> The difference between time stamps here is 5 min, but you can notice that 
> there is a big difference between the average and maximum values, which 
> may mean that there is a certain resolution that is lower than 5 minutes, 
> or in other words, the MRTG can sense peak utilization values in an 
> interval which is lower than 5 minutes or it has a polling interval to the 
> devices less than 5 minutes.
> Does that make sense?
> And please I want to know this sampling interval.
> Thanks a lot.
> Best Regards,
> Mustafa



It's called normalization.  Not only is the difference 5 minutes, you will 
also see that every timestamp is a whole multiple of 5 minutes (300 
seconds).

Now consider that you are sampling not at 16:00 and 16:05, 16:10 and so on, 
but are sampling at 16:02, 16:07, 16:12 and so on. MRTG (or rather rateup) 
will still store it at 16:00, 16:05, 16:10.

If the counter value at 16:02 was 100,000 and the same counter was 103,000 
at 16:07, then the rate between 16:02 and 16:07 was 
(103,000-100,000)/(16:07-16:02) = 10.

If the rate before 16:02 was zero and the rate after 16:07 was also zero, 
then you get the following data:

between 16:00 and 16:02 rate=0
between 16:02 and 16:05 rate=10
between 16:05 and 16:07 rate=10
between 16:07 and 16:10 rate=0

Rateup combines the first two rates:
120 seconds @ 0/second  + 180 seconds @ 10/second = 120*0+180*10 = 1800 per 
300 seconds = 6/second.
Rateup combines the last two rates:
120 seconds @ 10/second  + 180 seconds @ 0/second = 120*10+180*0 = 1200 per 
300 seconds = 4/second.

Rateup stores:
16:05 average 6 max 10
16:10 average 4 max 10

Now consider the case where 16:07 to 16:12 is not rate 0 but rate 20.
between 16:05 and 16:07 rate=10
between 16:07 and 16:10 rate=20
Rateup combines:
120 seconds @ 10/second  + 180 seconds @ 20/second = 120*10+180*20 = 4800 
per 300 seconds = 12/second.

Rateup stores:
16:05 average 6 max 10
16:10 average 12 max 20

Look at the top of your log file. You will see the timestamp MRTG is working 
with as well as its input.  Copy those, look 5 minutes later, copy again, 
look 5 minutes later, copy again, do the math similar to what I did. It 
should match.