[rrd-users] Re: Problems with setting up RRD for counting firewallhits

[Alex van den Bogaerdt]

Torben Janssen wrote:

> i'm trying to set up a rrd to measure the hits in my firewall. i wrote a
> script, that check
> the firewall-log and count the hits per minute.

You need the rate which you query from the firewall to go into RRDtool
"as is" --> use gauge.

> i used:
> rrdtool create firewall.rrd --step 60 -b -1year\
> DS:hits:ABSOLUTE:60:U:U \
> RRA:MAX:0.999:1:1440

After inserting a space between "year" and "\" this works.
What I don't get is: why do you set the start to one year ago?
You are updating with times near "now" so you should probably
use a start time of 1029925740

> my script only add data to the rrd when at least one hit per minute was
> logged. i thought
> that for every minute where no data is added the value is NaN.

Not at all.  First of all: your results are different from my
results.  When I run your commands I get plenty of NaN values.
My guess is that you used another command to create the database,
this is probably the case since above command cannot work...

[snip]

> i cannot understand that data. i would like to have the values
> 15,1,NaN,1,4,2,2,6,4,NaN,2,....

Use GAUGE.  You are using ABSOLUTE which means RRDtool should
process the numbers as follows:  "rate=number/time_lapsed"
You want: "rate=number"

Then there's this thing about the validity of each update.  The
computed rate (which is, for GAUGE, just the number you enter)
is valid from the previous update time to the current update time.
If this time period is too large (as defined by heartbeat), the
rate is changed into UNKNOWN (NaN).

This means your first update at 1029925800 is not taking place,
only the "last update" time is set.  RRDtool cannot do anything
else because it cannot determine the amount of time.

Your next update is at 1029925860; this means the time inbetween
updates is 60 seconds which is no more than the heartbeat time.
This update is successful.  The next update, at 1029925980, tries
to define a rate for the time period 1029925860 to 1029925980. This
is much larger than your heartbeat setting.

Try the same commands again.  Be sure to:
- create a new database
- use rrdtool version 1.0.38
- use DST type GAUGE
- do update each minute.  If no data is available, update
  using the unknown value (just type U in stead of a number).

Hint for your first update value:
You want to define the time between 1029925740 and 1029925800
to be at rate 15.  To do so you MUST update at 1029925740 (with
value "U") and at 1029925800 (with value 15).

HTH
-- 
   __________________________________________________________________
 / alex at slot.hollandcasino.nl                  alex at ergens.op.het.net \
| work                                                         private |
| My employer is capable of speaking therefore I speak only for myself |
+----------------------------------------------------------------------+
| Technical questions sent directly to me will be nuked. Use the list. | 
+----------------------------------------------------------------------+
| http://faq.mrtg.org/                                                 |
| http://rrdtool.eu.org  --> tutorial                                  |
+----------------------------------------------------------------------+

--
Unsubscribe mailto:rrd-users-request at list.ee.ethz.ch?subject=unsubscribe
Help        mailto:rrd-users-request at list.ee.ethz.ch?subject=help
Archive     http://www.ee.ethz.ch/~slist/rrd-users
WebAdmin    http://www.ee.ethz.ch/~slist/lsg2.cgi