[rrd-users] retroactively graphing data from logfile (newbie)

[Ryan Tracey]

Hi
I am trying to graph some events that occurred on a mail server a
while ago. I have concatenated the daily logs into one huge file, then
parsed it with a python script to create a file that contains per-hour
data. E.g:

2005-05-03-12 102518 16 119 278 406 27 9 1145 0 
2005-05-03-13 127723 22 273 426 488 29 2 1264 0 

Where the first column is the time and hour.   The columns that follow
contain the occurences of a given type in that hour.

I created the following rrd. 

rrdtool create hugelog.rrd \
--start 1114833600 \
--step 3600 \
DS:sync_error:GAUGE:3600:0:100000 \
DS:helo_ip:GAUGE:3600:0:100000 \
DS:helo_strange:GAUGE:3600:0:100000 \
DS:sender_verify:GAUGE:3600:0:100000 \
DS:greylist:GAUGE:3600:0:100000 \
DS:malform_mime:GAUGE:3600:0:100000 DS:unaccept_attach:GAUGE:3600:0:100000 \
DS:zipfile:GAUGE:3600:0:100000 \
DS:malware:GAUGE:3600:0:100000 \
RRA:AVERAGE:0.5:1:24


Then, with the aid of another python script, for each line of the
per-hour file entered the data. Example:

rrdtool update hugelog.rrd -t \
sync_error:\
helo_ip:\
helo_strange:\
sender_verify:\
greylist:\
malform_mime:\
unaccept_attach:\
zipfile:\
malware \
1115110805:67846:4:82:157:318:12:1:426:0

Then I tried to graph it.  The graph looks nothing like what I expected. 

rrdtool graph foo.png \
--imgformat PNG \
--start 1114833600 \
--end 1115524800 \
--title 'foo' \
DEF:se=hugelog.rrd:sync_error:AVERAGE  \
LINE1:se#0000FF:"foo "


Firstly, what am I doing wrong?  I will attach the rrd (hugelog.rrd:
not sure if the list will accept, though.)

Secondly, am I just introducing unneccessary complexity by
preprocessing the original log file and creating a per-hour file?

I am really keen to to understand how rrdtool works; but I am a
learn-by-example kinda guy.  Or learn by trial-and-error, whichever
comes first ;-)

Thanks and regards,
Ryan

-- 
Ryan Tracey
Citizen: The World

-- Attached file removed by Ecartis and put at URL below --
-- Type: image/png
-- Size: 1k (1724 bytes)
-- URL : http://lists.ee.ethz.ch/p/foo.png


-- Attached file removed by Ecartis and put at URL below --
-- Type: application/octet-stream
-- Size: 4k (4764 bytes)
-- URL : http://lists.ee.ethz.ch/p/hugelog.rrd


--
Unsubscribe mailto:rrd-users-request at list.ee.ethz.ch?subject=unsubscribe
Help        mailto:rrd-users-request at list.ee.ethz.ch?subject=help
Archive     http://lists.ee.ethz.ch/rrd-users
WebAdmin    http://lists.ee.ethz.ch/lsg2.cgi