[rrd-users] beginner questions on multiple series

[Raimund Berger]

SecretCode <secretcode343 at gmail.com> writes:

> Hi ... I have done some basic work with rrdtool but I'm still a beginner.
>
> I'm trying to report on traffic usage through a firewall for multiple IP 
> addresses. Each address will have in & out values, but I don't know in 
> advance how many addresses there will be - and new addresses could 
> theoretically be added during any collection interval.
>
> Am I right that each IP address's traffic would be a separate series and 
> would have to be a separate RRD file (because each RRD has a sized fixed 
> up-front)? Is this going to be manageable with rrdtool?

The requirement of
* tracking each ip individually and
* allowing new ip's to be added at run time
already implies that each ip has to have it's own rrd, because you
can't just add a new "value" field to an exisiting rrd.

I'd say this sure can be handled by rrdtool, but depending on what
data you want to collect it might put some load on your system,
especially the disk(s) as has been previously discussed on this list.

More specifically, you didn't say if you want to track e.g.
* tcp connection requests (syn packets) and/or
* total bandwidth consumption of an ip and/or
* each single packet going to and fro an ip
where the workload would of course increase noticably in each case.

Also, you'll gonna need a tool to *collect* the data, and which will
do other stuff for you like creating a new rrd for new ip's
automagically at run time.

Assuming we're not talking an enterprise class environment with
hundreds/thousands of ip's sitting inside your network, I guess I can
recommend collectd for these kinds of purposes. You'll find it to be
very much "plug&play", albeit not including a graphing solution yet. A
deficiency which can be worked around though.

Regards,
R.