[rrd-users] Correct CDEF to get the spam count right?

[Vincent Li]

Hi,

I am new to rrdtool, and I am using parselog http://rekudos.net/parselog/ 
to parse amavisd-new log. Parselog create rrd files and parselog-cgi 
graph the rrd files. Here is the relevant  rrd database definition:

'DS:hits:ABSOLUTE:'.$step.':0:U'
RRA:AVERAGE:0.5:1:576
RRA:AVERAGE:0.5:12:576 
RRA:AVERAGE:0.5:288:367

and my DEF/CDEF debug dump result:

DEF:def0=_star/Blocked_BANNED.rrd:hits:AVERAGE 
CDEF:cdef0=0,def0,+,UN,0,def0,172800,*,IF
AREA:cdef0#ff0000:Blocked BANNED 
GPRINT:cdef0:AVERAGE:\:%5.1lf msgs

DEF:def1=_star/Blocked_INFECTED.rrd:hits:AVERAGE 
CDEF:cdef1=0,def1,+,UN,0,def1,172800,*,IF
STACK:cdef1#8e2323:Blocked 
INFECTED GPRINT:cdef1:AVERAGE:\:%5.1lf msgs

DEF:def2=_star/Blocked_SPAM.rrd:hits:AVERAGE 
CDEF:cdef2=0,def2,+,UN,0,def2,172800,*,IF
STACK:cdef2#ffff00:Blocked SPAM 
GPRINT:cdef2:AVERAGE:\:%5.1lf msgs

DEF:def3=_star/Passed_CLEAN.rrd:hits:AVERAGE 
CDEF:cdef3=0,def3,+,UN,0,def3,172800,*,IF
STACK:cdef3#00ff00:Passed CLEAN 
GPRINT:cdef3:AVERAGE:\:%5.1lf msgs

There are major  Blocked_BANNED,Passed_CLEAN count differences between the 
number shown on the graph and my simple unix grep count. The Blocked_SPAM 
counts differences seems not that much.

There are quite some long periods that Blocked_BANNED, Passed_CLEAN 
type message are zero or unknown.

I am just wondering what is the correct CDEF to caculate the  total counts
of those type of messages or is there something wrong with the way to 
feed the counts to rrd files?

Thanks in advance!

Vincent
http://bl0g.blogdns.com