[rrd-users] Problem with graphing counter and average/max values

[Westlake, Simon]

I'm graphing a variety of different statistics on some switches using
MRTG+RRDtool, which is working very well. I use MRTG to poll the devices
and generate the RRD files, and then I generate the graphs via the
rrdgraph function (using php4-rrdtool) to provide more control over the
graph size/output.

This is working very well for throughput and CPU usage.

I decided to begin graphing discarded packets and error packets on my
switches (using ifIn/OutErrors and ifIn/OutDiscards). Doing an snmpget
to a switch using the appropriate OID gives an expected value - a
counter of the total number of errors/discards on that interface.

So, I built my MRTG configuration.

Directory[DAS-c30-errors]: DAS-c30
Title[DAS-c30-errors]: Error Packets
Target[DAS-c30-errors]: ifInErrors.10001&ifOutErrors.10001:snmpkey at ip
Options[DAS-c30-errors]: growright,nobanner,nolegend,nopercent
MaxBytes[DAS-c30-errors]: 1000000000

I don't have a need for some of the MRTG options as I'm not using an
MRTG cgi to generate my graphs. I set the max bytes to a large value in
case of a large number of errors occurring during a period.

So, here is a look at the RRD file that MRTG has generated. Ds0 is input
errors and ds1 is output errors. The ds[ds0].last_ds value matches what
I get from an snmpget.

filename = "DAS-c30/das-c30-errors.rrd"
rrd_version = "0001"
step = 300
last_update = 1163684402
ds[ds0].type = "COUNTER"
ds[ds0].minimal_heartbeat = 600
ds[ds0].min = 0.0000000000e+00
ds[ds0].max = 1.0000000000e+09
ds[ds0].last_ds = "249447"
ds[ds0].value = 5.6666666667e-01
ds[ds0].unknown_sec = 0
ds[ds1].type = "COUNTER"
ds[ds1].minimal_heartbeat = 600
ds[ds1].min = 0.0000000000e+00
ds[ds1].max = 1.0000000000e+09
ds[ds1].last_ds = "0"
ds[ds1].value = 0.0000000000e+00
ds[ds1].unknown_sec = 0

Here is the graph it generated yesterday.

http://m2.twcwi.com/das-c30-discards-max.png

I definitely did not have almost 600m errors within a 5 minute period.
The interesting thing is that the 'PRINT' information below the graph
does not show the same thing as the graph (shows <1 error for max, as
opposed to 600m.) I'm sure I'm doing something wrong, but I've been
trying to figure it out for a couple of days to no avail. Here is my
graph generation code (using php4-rrdtool):

$opts = array( "--start", "$date3", "--end", "$date4",  "-v Discards &
Errors", "-t Discarded and Error Packets",
 
"DEF:discardin=mrtg/DAS-c$circuit/das-c$circuit-discards.rrd:ds0:AVERAGE
",
 
"DEF:discardout=mrtg/DAS-c$circuit/das-c$circuit-discards.rrd:ds1:AVERAG
E",
 
"DEF:errorin=mrtg/DAS-c$circuit/das-c$circuit-errors.rrd:ds0:AVERAGE",
 
"DEF:errorout=mrtg/DAS-c$circuit/das-c$circuit-errors.rrd:ds1:AVERAGE",
          "AREA:discardin#009900:In Discards",
          "LINE2:discardout#0000ff:Out Discards",
          "LINE2:errorin#FF26FF:In Errors",
          "LINE2:errorout#FF0000:Out Errors",
          "PRINT:discardin:MAX:<BR><table width=\"550\" border=\"0\"
align=\"center\"><TR><TD align=\"center\"><span class=smallfont>Max
<font color=\"#009900\">Discards In\: %1.1lf</font></td>",
          "PRINT:discardout:MAX:<TD align=\"center\"><span
class=smallfont>Max <font color=\"#0000ff\">Discards Out\:
%1.1lf</font></td>",
          "PRINT:errorin:MAX:<TD align=\"center\"><span
class=smallfont>Max <font color=\"#FF26FF\">Errors In\:
%1.1lf</font></td>",
          "PRINT:errorout:MAX:<TD align=\"center\"><span
class=smallfont>Max <font color=\"#FF0000\">Errors Out\:
%1.1lf</font></td></tr>",
          "PRINT:discardin:LAST:<TR><TD align=\"center\"><span
class=smallfont>Current <font color=\"#009900\">Discards In\:
%1.1lf</font></span></td>",
          "PRINT:discardout:LAST:<TD align=\"center\"><span
class=smallfont>Current <font color=\"#0000ff\">Discards Out\:
%1.1lf</font></span></td>",
          "PRINT:errorin:LAST:<TD align=\"center\"><span
class=smallfont>Current <font color=\"#FF26FF\">Errors In\:
%1.1lf</font></span></td>",
          "PRINT:errorout:LAST:<TD align=\"center\"><span
class=smallfont>Current <font color=\"#FF0000\">Errors Out\:
%1.1lf</font></span></td></tr>",
          "PRINT:discardin:AVERAGE:<tr><TD align=\"center\"><span
class=smallfont>Average <font color=\"#009900\">Discards Inbound\:
%1.1lf</font></td>",
          "PRINT:discardout:AVERAGE:<TD align=\"center\"><span
class=smallfont>Average <font color=\"#0000ff\">Discards Outbound\:
%1.1lf</font></span></td>",
          "PRINT:errorin:AVERAGE:<TD align=\"center\"><span
class=smallfont>Average <font color=\"#FF26FF\">Errors In\:
%1.1lf</font></td>",
          "PRINT:errorout:AVERAGE:<TD align=\"center\"><span
class=smallfont>Average <font color=\"#FF0000\">Errors Out\:
%1.1lf</font></span></td></tr></table>"
          );

Sorry for the somewhat irrelevant HTML spam. So, there is my problem #1.
As you can see, my graph generation code is pretty simplistic and I
really can't see an error in it. Conversely, todays graph appears to be
correct - the graph shows a max of ~4 and the max error PRINT statement
shows 3.8. So there is some strange discrepancy somewhere..

Problem #2 is that I decided I'd like to add a line to the graphs,
showing the maximum value polled during the displayed time period. Since
I am graphing 'AVERAGE', I beleived if I drew a line using 'MAX', it
would show the maximum value for that period. It appears to draw exactly
the same line as 'AVERAGE'. Am I misunderstanding how to utilize this
function? Is there some other way I can grab the maximum value polled
from the rrd file and draw it?

Thanks for any assistance you can provide.

--
Simon Westlake
Time Warner Cable Business Class
Network Engineer
Ph: 414.908.4791 | Cell: 414.688.7956


-----------------------------------------
This E-mail and any of its attachments may contain Time Warner
Cable proprietary information, which is privileged, confidential,
or subject to copyright belonging to Time Warner Cable. This E-mail
is intended solely for the use of the individual or entity to which
it is addressed. If you are not the intended recipient of this
E-mail, you are hereby notified that any dissemination,
distribution, copying, or action taken in relation to the contents
of and attachments to this E-mail is strictly prohibited and may be
unlawful. If you have received this E-mail in error, please notify
the sender immediately and permanently delete the original and any
copy of this E-mail and any printout.


--
Unsubscribe mailto:rrd-users-request at list.ee.ethz.ch?subject=unsubscribe
Help        mailto:rrd-users-request at list.ee.ethz.ch?subject=help
Archive     http://lists.ee.ethz.ch/rrd-users
WebAdmin    http://lists.ee.ethz.ch/lsg2.cgi