[rrd-users] various questions on rrdcreate/rrd_create
linux at thehobsons.co.uk
Thu Apr 21 00:28:10 CEST 2011
Rick Jones wrote:
>First a "style" question I suppose. Let's say for the sake of argument
>I decided to write my own "take sFlow counters and shove them into an
>RRD" program. Each interface has a number of counters. One can specify
>more than one DS per RRD but it seems that ntop for example has decided
>to create one per stat:
>root at tardy:/usr/local/var/ntop/rrd/interfaces/sFlow-device.2/sFlow/45#
>drwx------ 2 root root 4096 2011-04-12 11:34 ./
>drwx------ 54 root root 4096 2011-04-08 15:50 ../
>-rw------- 1 root root 59968 2011-04-15 15:57 ifInBroadcastPkts.rrd
>-rw------- 1 root root 59968 2011-04-08 16:07 ifInDiscards.rrd
>-rw------- 1 root root 59968 2011-04-20 11:06 ifInMulticastPkts.rrd
>-rw------- 1 root root 59968 2011-04-20 11:06 ifInOctets.rrd
>-rw------- 1 root root 2126656 2011-04-20 11:06 ifInUcastPkts.rrd
>-rw------- 1 root root 59968 2011-04-20 11:06 ifOutBroadcastPkts.rrd
>-rw------- 1 root root 59968 2011-04-20 11:06 ifOutDiscards.rrd
>-rw------- 1 root root 59968 2011-04-20 11:06 ifOutMulticastPkts.rrd
>-rw------- 1 root root 59968 2011-04-20 11:06 ifOutOctets.rrd
>-rw------- 1 root root 59968 2011-04-20 11:06 ifOutUcastPkts.rrd
>Before I simply, blithely mimic that, is there any best practice?
It's largely a matter of what suits your situation.
Where there is a likelyhood of the number of datasets changing then
you are better off with separate files. An example of that would be
monitoring disk space where you may add or remove a filesystem. In
that case you'd probably want one file per filesystem.
On the other hand, for an ethernet interface, I'd have combined those
separate files into one since the set of values being logged isn't
likely to change.
Another factor is whether all the data values are going to be
available at the same time. You cannot do a partial update - so you
cannot update one dataset at one point in time, and another at a
different time, when they are in the same RRD file. If you can
collect all the data values at once (which would be the case with an
ethernet interface), then it's one call to update them all rather
than updating each separate file individually.
>Also, when creating with --no-overwrite, what happens if the second or
>Nth create has a different value for things like step or heartbeat? Are
>they simply ignored or does some sort of "conversion" take-place?
If you don't overwrite the file, then nothing gets changed.
>Looking at the output of rrdtool dump on one of those RRDs above, am I
>correct in assuming that when apart from perhaps the
>forcasting/specialized RRAs all RRAs are derived from Primary Data
>Points and don't "cascade?"
Correct. I believe the way it works is that each RRA has it's own
accumulator, and as each primary 'bucket' is completed, the
accumulator for each RRA is updated with the value in the bucket. As
each consolidated time period is completed, then a new consolidated
data point is generated.
You can easily see that the consolidations aren't always cascadable
since you could (for example) you could consolidate over 5 and 12
minute periods which only coincide once an hour.
Visit http://www.magpiesnestpublishing.co.uk/ for books by acclaimed
author Gladys Hobson. Novels - poetry - short stories - ideal as
Christmas stocking fillers. Some available as e-books.
More information about the rrd-users