[rrd-users] Re: How to differ spikes from real traffic

[Mark Rowlands]

On Monday 27 May 2002 9:17 am, Gerhard Ecaroh Froehlich wrote:
> Hi,
>
> i've set up RRDTool (SNMP) and everything works fine. So me too has some
> spikes in the graphs. But most of them are looking like there just heavy
> traffic when copying large files or databases. So how can i differ short
> heavy network traffic from spikes? Should i imagine a real spike as
> "single" line up or can there be 2,3 or 4 upgoing lines around? Are there
> other ways to differ real traffic from sudden spikes?
>
> I feel this is difficult cause our network is pretty good and consists
> mainly of routers and switches and therefor is capable of transfering up to
> 100 MBit (Gigabit lines too). Interfaces are allmost all SunQuad NIC. And
> it's not easy to track down whether a cron made a backup or it's just
> another machine in that bunch of hundreds of servers doing something other.
>

Well I am loath to throw the spikes away, they may be evidence that something 
you don't know about is going on..... on the otherhand they can also disguise 
the normal pattern of data.

I usually use two graphs, one that sets  a cap on or around the max expected 
usual value (-u 200 -r ) and one that is unlimilted to alert me for  unusual 
events. 

The other  (better?) option to "hide" the odd data is in the friendly 
manual..... see the cdef tutorial

--
Unsubscribe mailto:rrd-users-request at list.ee.ethz.ch?subject=unsubscribe
Help        mailto:rrd-users-request at list.ee.ethz.ch?subject=help
Archive     http://www.ee.ethz.ch/~slist/rrd-users
WebAdmin    http://www.ee.ethz.ch/~slist/lsg2.cgi