[rrd-users] Re: All for nothing

[Tobias Oetiker]

Today Matthias Mikuletz wrote:

>

> In stable 1.0.37 there is a hint in the documentation ( "..consolidation
> function (CF) (averag,minimum,maximum,TOTAL,last)"). I didn't check until
> now if it's also really implemented.

this is not implemented ... it was implemented at some point but
has been removed ... for the reasons stated in the other mail ...
in the 1.1.x there are new features in the gaphing component which
let you do the 'build average over periode, multiply with number of
seconds in periode' thing in a simple manner ...

> If I'm for instance measuring dropped packets on a firewall, which in my
> case is a counter, then I get something like '65 dropped packets in the
> last five minutes (update interval 300s). But in the next consolidation
> archive, e.g. accumulated to hours, I'm not interested in 'average
> number of packets dropped per 5 minutes, but in 'packets dropped per
> hour'. And in the yearly overview I'm interested in 'packets dropped per
> day'.

Well, I guess you are confising RRAs with graphs. Data in RRAs is
always 'per second' ... so if you gather packet drops every 5
minutes, rrdtool will still log data in drops per second ... it is
important to pick the right data source type for this ... you are
maybe thinking about using gauge for such an application, but this
is wrong. It will either be counter or absolute, depending on
whether the packet drops are measured by a continouses counter or
as absolute numbers within a certain interval ...

> But I can imagine many situations, at least in the case of using a
> counter, where it is much more adequate to grow the scale of the y-axis
> while growing the scale of the x-axis.
> (The picture should be getting bigger in both directions)
>
> Imagine I read a counter of emails containing a virus getting caught by
> my mx scan engine. I have a tool (cacti. cacti is great!) that counts
> different things every 5 minutes. So it also counts the virusses every 5
> mins. But this number is usually small, often zero.
> In the end after having consolidated a few times using 2 or 3 RRA's
> (weekly, monthly, yearly), I come up with 'average number of virusses
> caught per 5 minutes at some day (one consolidated point per day). This is
> ridiculous. What I obviously want to know is 'number of virusses per day'.
> And in the other RRA's I will want to know e.g. 'number of virusses per
> hour'.
>
> I really think that this is quite a commonly wanted way to look at
> consolidated counters, isn't it?

Sure, but this is only presentation ... the internal data format
is irrelevant as long as it is consistant ... you can draw graphs
'per whatever unit of time you want' this is very simple ....

> Certainly you then have to label the y-axes accordingly.
> (can this be done?)

the bit yaxis lable is free form ... the small ones are automatic
...

Check the mailinglist archive, and you will find several repeats of
this very same discussion, this is why I am a bit eddgy about it
...

cheers
tobi

-- 
 ______    __   _
/_  __/_  / /  (_) Oetiker, ETZ J97, ETH, 8092 Zurich, Switzerland
 / // _ \/ _ \/ / phoneto:+41(0)1-632-5286  faxto:+41(0)1-632-1517
/_/ \.__/_.__/_/ oetiker at ee.ethz.ch http://google.com/search?q=tobi

--
Unsubscribe mailto:rrd-users-request at list.ee.ethz.ch?subject=unsubscribe
Help        mailto:rrd-users-request at list.ee.ethz.ch?subject=help
Archive     http://www.ee.ethz.ch/~slist/rrd-users
WebAdmin    http://www.ee.ethz.ch/~slist/lsg2.cgi