[rrd-users] Re: Big rrd files (too big !)

[Vial, Sylvain]

And what do you think about Orca from Orcaware
(http://www.orcaware.com/orca/)?
I think the honeynet brazilian team have used that software to generated
the graphs from their reports.
I know that these graphs are generated from text files but I don't know
what it the structure of these txt files.
So for the moment I'm reading carefully the documentation.
Maybe I will ask to the honeynet.br team how they have done to generate
their graphs because my project must be achieved in less than one month.
I need to find a solution rapidly.

Thanks for your advices. 

-----Original Message-----
From: Serge Maandag [mailto:serge.maandag at staff.zeelandnet.nl] 
Sent: Monday, May 23, 2005 4:40 PM
To: Vial, Sylvain; rrd-users at list.ee.ethz.ch
Subject: RE: [rrd-users] Re: Big rrd files (too big !)

> I need to create reports for tcp_source_ip_addresses, 
> udp_source_ip_addresses, tcp_destination_ports and 
> udp_destination_ports.

That's something ntop does quite nicely.
Argus is a great tool for capturing traffic and sorting or
Summarizing it.


> For the moment the best way I found is to generated 4 lists 
> (4 top ten).
> But I want 4hours period reports and 1 daily reports for each 
> list. So I obtain 28 reports that I have to sort to eliminate 
> duplicated values.

O.k...

> For me, I understood that I have to create one rrd file per 
> dest/src port/ip-addr (tcp/udp) I have in my 4 lists.
> For each rrd files, I create 2 data sources in order to 
> display graphs in bytes or packets, but then I don't know how 
> many RRA I have to create.

Just look at how many pixels wide you want to plot your graph.
That's about the number of rows your RRA must hold. A bit more
Usually is wise. For every view (4 hours, 1 day) recalculate the
Number of rows needed and create an RRA that big.

> I don't know what is the aim to create RRA, for example, for 
> a weekly archive, monthly archive, etc if it's, for example, 
> display graph for one month of captured flows.

You can make one big RRA that spans a year in 5 minute samples,
But you are not going to use that many samples in your yearly
Graph. Therefore it would only eat disk space and processing time.
Tailor made RRA's prevent that. One for every view.

> I think this have a big influence on the size of the rrd files.

It sure can.


-------------
Op de inhoud van dit e-mailbericht en de daaraan gehechte bijlagen is de
inhoud van de volgende disclaimer van toepassing:
http://www.zeelandnet.nl/disclaimer.php

-------------
For the content of this e-mail message and its attachment(s) the
following disclaimer applies: http://www.zeelandnet.nl/disclaimer.php

--
Unsubscribe mailto:rrd-users-request at list.ee.ethz.ch?subject=unsubscribe
Help        mailto:rrd-users-request at list.ee.ethz.ch?subject=help
Archive     http://lists.ee.ethz.ch/rrd-users
WebAdmin    http://lists.ee.ethz.ch/lsg2.cgi