[rrd-users] Re: Big rrd files (too big !)
serge.maandag at staff.zeelandnet.nl
Mon May 23 23:40:23 MEST 2005
> I need to create reports for tcp_source_ip_addresses,
> udp_source_ip_addresses, tcp_destination_ports and
That's something ntop does quite nicely.
Argus is a great tool for capturing traffic and sorting or
> For the moment the best way I found is to generated 4 lists
> (4 top ten).
> But I want 4hours period reports and 1 daily reports for each
> list. So I obtain 28 reports that I have to sort to eliminate
> duplicated values.
> For me, I understood that I have to create one rrd file per
> dest/src port/ip-addr (tcp/udp) I have in my 4 lists.
> For each rrd files, I create 2 data sources in order to
> display graphs in bytes or packets, but then I don't know how
> many RRA I have to create.
Just look at how many pixels wide you want to plot your graph.
That's about the number of rows your RRA must hold. A bit more
Usually is wise. For every view (4 hours, 1 day) recalculate the
Number of rows needed and create an RRA that big.
> I don't know what is the aim to create RRA, for example, for
> a weekly archive, monthly archive, etc if it's, for example,
> display graph for one month of captured flows.
You can make one big RRA that spans a year in 5 minute samples,
But you are not going to use that many samples in your yearly
Graph. Therefore it would only eat disk space and processing time.
Tailor made RRA's prevent that. One for every view.
> I think this have a big influence on the size of the rrd files.
It sure can.
Op de inhoud van dit e-mailbericht en de daaraan gehechte bijlagen is de inhoud van de volgende disclaimer van toepassing: http://www.zeelandnet.nl/disclaimer.php
For the content of this e-mail message and its attachment(s) the following disclaimer applies: http://www.zeelandnet.nl/disclaimer.php
Unsubscribe mailto:rrd-users-request at list.ee.ethz.ch?subject=unsubscribe
Help mailto:rrd-users-request at list.ee.ethz.ch?subject=help
More information about the rrd-users