[rrd-users] Re: traffic volume recording

[Michael Bunk]

> There are several ways to accomplish this.  However, due to data
> normalization and consolidation rrdtool may not always be the right
> tool.  Sometimes it's better to use regular databases, like SQL.

Most exact would be to read out ifInOctets once a day and calculate the 
difference from the last day. But I actually want something more stable, eg. 
when the counter gets reset during the day because the machine or router 
whose traffic is monitored gets reset, I want to already have the traffic 
volume transferred so far. Also, using COUNTER, rrdtool could handle the 
counter wraps.

I see that rrdtool could introduce some incorrectness, but when it also 
introduces robustness, I would go for it.

Instead of averaging the bytes/s over the day, I can also imagine using GAUGE 
and recording the MIN and MAX for the day. But again, this fails on a counter 
wrap or reset.

Mabe also my time scale is too large. I could average the bytes/s in CDPs 
every hour and in the end of the day fetch and add them. But I'm still hoping 
to get around this.

> > step = 300
> > DS:ds0:DERIVE:1800:0:NaN
> > RRA:AVERAGE:0.5:288:600
> >
> > The DS gets the bytes/sec from the network interface. I didn't want to
> > use GAUGE here, because if fear counter wraps.
>
> I think you're on the wrong track here.  DERIVE should get bytes, not
> bytes per second, unless you want to monitor bytes/(second*second) i.e.
> the growth of throughput vs. throughput itself.

I was not clear. rrdtool update gets bytes and DERIVE should make bytes/s.

> > As the whole thing didn't run for a complete day yet, I only fetch
> > 'UNKNOWN' values from my RRA. That is why I think of adjusting the xff
> > value.
>
> Ignoring unknown values by setting xff is like sticking your head in
> the sand, like ostriches do.  Suppose you set xff to 0.99999999999.....
>  then one valid PDP would show up as a whole day of valid PDPs.  Is
> that really what you want?

Now that I understand xff better, I can understand as well that I don't want 
to adjust it :)

Another thought is using something like
	DS:ds7:COMPUTE:ds1,UN,0,ds1,IF::
ie. to make UNKNOWN to zero, so averaging can work.

> By the way: step = 300  and  RRA:AVERAGE:0.5:288:600  means 00:00 UTC
> to 00:00 UTC, not midnight to midnight local time.

You mean I should watch out to use start and end time of the fetch command 
correctly?

Kindest regards,
 Michael Bunk

--
Unsubscribe mailto:rrd-users-request at list.ee.ethz.ch?subject=unsubscribe
Help        mailto:rrd-users-request at list.ee.ethz.ch?subject=help
Archive     http://lists.ee.ethz.ch/rrd-users
WebAdmin    http://lists.ee.ethz.ch/lsg2.cgi