[rrd-users] Re: Confirm what I am getting

[Alex van den Bogaerdt]

Mike wrote:

> What I do:
> 1) Parse through syslog output looking for packets that were denied
> access by a filter.  I add up the number of packets that were denied
> (both total and ICMP only) for a 5 minute period.

This looks similar to a counter that is reset on reading it.

> What I am trying to do is get a count of the number of packets that were
> denied access (both total and ICMP only) for a given period of time.
> Currently, I'm hard coding that to 5 minutes for development and until I
> understand RRDTool better.

> My updates then take the form of:
> rrdtool update acllog.rrd 1010074250:105:99

If you hard code 5 minutes, 1010074250 should be a multiple of 300...
Visit faq.mrtg.org and search for normalization to find out why.

> Based on what I've read (and what I've "borrowed" (<G>) from the
> Tutorial and the mailing list archives), I believe that the graphs will
> be based on the number of packets that arrived over a 5 minute period.
> 
> Am I correct?

Based on a quick scan of this mail I would say yes (apart from the
timestamp that is).  You can easily check this by keeping track of
your input.  When you store those numbers in a separate file for
later reference, you should be able to compare them with your image.
Also, if you divide those numbers by 300 you can compare them to
a database dump or to the output of rrdtool fetch.

There is however one problem with your approach.  RRDtool should
be displaying rejects per second, not per 5 minutes.  You can do
what you're doing but you may run into trouble if you don't do
it right.  So far you seem to do fine, just be careful.

HTH
-- 
   __________________________________________________________________
 / alex at slot.hollandcasino.nl                  alex at ergens.op.het.net \
| work                                                         private |
| My employer is capable of speaking therefore I speak only for myself |
+----------------------------------------------------------------------+
| Technical questions sent directly to me will be nuked. Use the list. | 
+----------------------------------------------------------------------+
| http://faq.mrtg.org/                                                 |
| http://rrdtool.eu.org  --> tutorial                                  |
+----------------------------------------------------------------------+

--
Unsubscribe mailto:rrd-users-request at list.ee.ethz.ch?subject=unsubscribe
Help        mailto:rrd-users-request at list.ee.ethz.ch?subject=help
Archive     http://www.ee.ethz.ch/~slist/rrd-users
WebAdmin    http://www.ee.ethz.ch/~slist/lsg2.cgi