[rrd-users] various questions on rrdcreate/rrd_create

[Simon Hobson]

Rick Jones wrote:
>First a "style" question I suppose.  Let's say for the sake of argument
>I decided to write my own "take sFlow counters and shove them into an
>RRD" program.  Each interface has a number of counters.  One can specify
>more than one DS per RRD but it seems that ntop for example has decided
>to create one per stat:
>
>root at tardy:/usr/local/var/ntop/rrd/interfaces/sFlow-device.2/sFlow/45#
>ll
>total 2628
>drwx------  2 root root    4096 2011-04-12 11:34 ./
>drwx------ 54 root root    4096 2011-04-08 15:50 ../
>-rw-------  1 root root   59968 2011-04-15 15:57 ifInBroadcastPkts.rrd
>-rw-------  1 root root   59968 2011-04-08 16:07 ifInDiscards.rrd
>-rw-------  1 root root   59968 2011-04-20 11:06 ifInMulticastPkts.rrd
>-rw-------  1 root root   59968 2011-04-20 11:06 ifInOctets.rrd
>-rw-------  1 root root 2126656 2011-04-20 11:06 ifInUcastPkts.rrd
>-rw-------  1 root root   59968 2011-04-20 11:06 ifOutBroadcastPkts.rrd
>-rw-------  1 root root   59968 2011-04-20 11:06 ifOutDiscards.rrd
>-rw-------  1 root root   59968 2011-04-20 11:06 ifOutMulticastPkts.rrd
>-rw-------  1 root root   59968 2011-04-20 11:06 ifOutOctets.rrd
>-rw-------  1 root root   59968 2011-04-20 11:06 ifOutUcastPkts.rrd
>
>Before I simply, blithely mimic that, is there any best practice?

It's largely a matter of what suits your situation.

Where there is a likelyhood of the number of datasets changing then 
you are better off with separate files. An example of that would be 
monitoring disk space where you may add or remove a filesystem. In 
that case you'd probably want one file per filesystem.
On the other hand, for an ethernet interface, I'd have combined those 
separate files into one since the set of values being logged isn't 
likely to change.

Another factor is whether all the data values are going to be 
available at the same time. You cannot do a partial update - so you 
cannot update one dataset at one point in time, and another at a 
different time, when they are in the same RRD file. If you can 
collect all the data values at once (which would be the case with an 
ethernet interface), then it's one call to update them all rather 
than updating each separate file individually.

>Also, when creating with --no-overwrite, what happens if the second or
>Nth create has a different value for things like step or heartbeat?  Are
>they simply ignored or does some sort of "conversion" take-place?

If you don't overwrite the file, then nothing gets changed.

>Looking at the output of rrdtool dump on one of those RRDs above, am I
>correct in assuming that when apart from perhaps the
>forcasting/specialized RRAs all RRAs are derived from Primary Data
>Points and don't "cascade?"

Correct. I believe the way it works is that each RRA has it's own 
accumulator, and as each primary 'bucket' is completed, the 
accumulator for each RRA is updated with the value in the bucket. As 
each consolidated time period is completed, then a new consolidated 
data point is generated.

You can easily see that the consolidations aren't always cascadable 
since you could (for example) you could consolidate over 5 and 12 
minute periods which only coincide once an hour.

-- 
Simon Hobson

Visit http://www.magpiesnestpublishing.co.uk/ for books by acclaimed
author Gladys Hobson. Novels - poetry - short stories - ideal as
Christmas stocking fillers. Some available as e-books.