[rrd-users] Re: Newbie problem

[listuser at numbnuts.net]

On Sat, 15 Mar 2003, Steve Robb wrote:

> David/Justin
> 
> The value that you are storing in the RRD is a number that represents a '5
> minute average expressed as units per second' which means that you need to
> multiply the stored value by 300 (secs) in order to display something that
> makes sense.
> 
> Using your example - 
> 
>    rrdtool graph spam-day.png --start -86400 \
>             DEF:rss=spam.rrd:RSS:AVERAGE \
>             DEF:dul=spam.rrd:DUL:AVERAGE \
>             DEF:spews=spam.rrd:SPEWS:AVERAGE \
>             DEF:spamhaus=spam.rrd:SPAMHAUS:AVERAGE \
>             DEF:socks=spam.rrd:SOCKS:AVERAGE \
>             DEF:sendmail_misc=spam.rrd:SENDMAIL_MISC:AVERAGE \
> new>        CDEF:5minrss=rss,300,* \
> new>        CDEF:5mindul=dul,300,* \
> new>        CDEF:5minspews=spews,300,* \
> new>        CDEF:5minspamhaus=spamhaus,300,* \
> new>        CDEF:5minsocks=socks,300,* \
> new>        CDEF:5minsendmail=sendmail,300,* \
> new>        LINE2:5minrss#FF0000:"Legend for rss"\
> new>        LINE2:5mindul#FF0000:"Legend for dul"\
> new>        ...etc

I've since made these changes and added another rrd to test with.  I 
noticed a little while ago that one was measures in k and the other 
wasn't.  It was then that I realized I forgot to multiply my new CDEF by 
300.  However it then dawned on my that the k was inaccurate.

(based on the example above with 6 stacked areas)
http://poplar.sktc.net/~shorej/spam-day.png

(based on the same data but the full 31 sources instead of 6, and grouped 
in two stacked areas)
http://poplar.sktc.net/~shorej/all-spam-day.png

The numbers I'm stuffing into the rrd usually range from 0-100 in 5 
minutes.  I generate the image for the new test rrd with this:

rrdtool graph ~/public_html/all-spam-day.png --start -86400 \
DEF:maps_rss=spam2.rrd:MAPS_RSS:AVERAGE \
DEF:maps_dul=spam2.rrd:MAPS_DUL:AVERAGE \
DEF:twombit=spam2.rrd:TWOMBIT:AVERAGE \
DEF:five_ten_sg=spam2.rrd:FIVE_TEN_SG:AVERAGE \
DEF:orss_dialups=spam2.rrd:ORSS_DIALUPS:AVERAGE \
DEF:orss_inputs=spam2.rrd:ORSS_INPUTS:AVERAGE \
DEF:orss_socks=spam2.rrd:ORSS_SOCKS:AVERAGE \
DEF:orss_spamsources=spam2.rrd:ORSS_SPAMSOURCES:AVERAGE \
DEF:orss_proxy=spam2.rrd:ORSS_PROXY:AVERAGE \
DEF:spews=spam2.rrd:SPEWS:AVERAGE \
DEF:spamhaus=spam2.rrd:SPAMHAUS:AVERAGE \
DEF:spamsites=spam2.rrd:SPAMSITES:AVERAGE \
DEF:flowgo=spam2.rrd:FLOWGO:AVERAGE \
DEF:dsbl_list=spam2.rrd:DSBL_LIST:AVERAGE \
DEF:dsbl_multihop=spam2.rrd:DSBL_MULTIHOP:AVERAGE \
DEF:visi_relays=spam2.rrd:VISI_RELAYS:AVERAGE \
DEF:sendmail_ralsky=spam2.rrd:SENDMAIL_RALSKY:AVERAGE \
DEF:sendmail_ciberlynx=spam2.rrd:SENDMAIL_CIBERLYNX:AVERAGE \
DEF:sendmail_cyrunner=spam2.rrd:SENDMAIL_CYRUNNER:AVERAGE \
DEF:sendmail_marin=spam2.rrd:SENDMAIL_MARIN:AVERAGE \
DEF:sendmail_empire=spam2.rrd:SENDMAIL_EMPIRE:AVERAGE \
DEF:sendmail_spam_isps=spam2.rrd:SENDMAIL_SPAM_ISPS:AVERAGE \
DEF:sendmail_richter=spam2.rrd:SENDMAIL_RICHTER:AVERAGE \
DEF:sendmail_hardigree=spam2.rrd:SENDMAIL_HARDIGREE:AVERAGE \
DEF:sendmail_acl_misc=spam2.rrd:SENDMAIL_ACL_MISC:AVERAGE \
DEF:sendmail_blocked=spam2.rrd:SENDMAIL_BLOCKED:AVERAGE \
DEF:sendmail_infected=spam2.rrd:SENDMAIL_INFECTED:AVERAGE \
DEF:sendmail_bad_domain=spam2.rrd:SENDMAIL_BAD_DOMAIN:AVERAGE \
DEF:sendmail_bogus=spam2.rrd:SENDMAIL_BOGUS:AVERAGE \
DEF:sendmail_relaying=spam2.rrd:SENDMAIL_RELAYING:AVERAGE \
DEF:sendmail_user_unk=spam2.rrd:SENDMAIL_USER_UNK:AVERAGE \
CDEF:5minspam=maps_dul,maps_rss,+,twombit,+,five_ten_sg,+,orss_dialups,+,orss_inputs,+,orss_socks,+,orss_spamsources,+,orss_proxy,+,spews,+,spamhaus,+,spamsites,+,flowgo,+,dsbl_list,+,dsbl_multihop,+,visi_relays,+,sendmail_ralsky,+,sendmail_ciberlynx,+,sendmail_cyrunner,+,sendmail_marin,+,sendmail_empire,+,sendmail_spam_isps,+,sendmail_richter,+,sendmail_hardigree,+,sendmail_acl_misc,+,sendmail_blocked,+,sendmail_infected,+,sendmail_bad_domain,+,sendmail_bogus,+,sendmail_relaying,+,sendmail_user_unk,+,300,* \
CDEF:5minmta=sendmail_blocked,sendmail_infected,+,sendmail_bad_domain,+,sendmail_bogus,+,sendmail_relaying,+,sendmail_user_unk,+,300,* \
AREA:5minmta#0000FF:"Total filtered non-RFC (2)822 mail" \
STACK:5minspam#FF0000:"Total filtered spam" \
--vertical-label "Mail filtered" \
--height "250" \
--width "650"

Sorry, the CDEF are going to wrap in a bad way.  The all-spam-day.png 
image has had the * 300 removed and the config above hasn't.  The image 
appears to be correct though.  The numbers seem right on to the data I'm 
also seeing in my email (echoing the variables out and totaling them in 
the same cron).  The spike at 14:45 is right according to the numbers in 
my cron output.  The numbers in the spam-day.png aren't right.  The 
spikeat 16:45 and 16:50 were 132 and 89 for Sendmail Misc.

So this makes me wonder, should I have * 300 in these configs?  Is there a 
time when you shouldn't use it?  All the DSs are of type gauge and all of 
my graphs are supposed to be averages.  Do you not multiply by 300 for 
gauge perhaps?  If not then I probably don't need a CDEF for those data 
sources then.

Thanks
 Justin

--
Unsubscribe mailto:rrd-users-request at list.ee.ethz.ch?subject=unsubscribe
Help        mailto:rrd-users-request at list.ee.ethz.ch?subject=help
Archive     http://www.ee.ethz.ch/~slist/rrd-users
WebAdmin    http://www.ee.ethz.ch/~slist/lsg2.cgi