Re: Erratic traffic spikes in Cricket obscuringgraphs

Sorry to respond to a response but I didn't get the original for some
reason.

> Michael Tiarnaigh schrieb:
> >
> > Hi all.
> >
> > Just a quick query to see if anyone has found a quick and effective
> > solution to this.
> >
> > I am having an issue with some Cricket graphs, whereby a single
> > erratic spike at a given time (I'm not sure what causes such spikes
to
> > be honest) obscures the rest of the data for that entire graph. For
> > instance, below is a typical case in point:

These are most often caused by unexpected resets of the SNMP counter on
the polled device. A secondary cause could be the counter wrapping in
the interval between polls. Checking -HC counters should resolve that if
you're not already using them.

> > I have found one solution to correcting this, but it's an extremely
> > time-consuming and tedious means of doing things. Basically, I dump
> > the contents of the back-end rrd file to an xml file ("rrdtool dump
> > ifName.rrd >> ifName.rrd.xml"), edit this file to find the time
stamp
> > in question where the spike occurred and manually delete these
entire
> > data rows. Save this file, and then do an rrd restore ("rrdtool
> > restore ifName.rrd.xml ifName.rrd"). This does solve the issue I
> > guess. It removes the spike, and as such, once I clear the
> > cricket-cache for these graphs, I can then see the correct data
again.
> > The problem with this is that firstly, I lose the data for that time
> > period, and secondly, it is an extremely time consuming process.

I used to use an addon perl script named 'killspike' to do the above in
the past. I believe I got it from the Cricket Contrib page.

> > Has anyone found a quicker way of eliminating these ridiculous
spikes,
> > or found a better work-around than the one I just described above?

You'll need to change your DS type to be DERIVE instead of COUNTER and
set rrd-min to 0. I'm not sure if it's possible to tune an existing rrd
file or if you'll need to start from scratch.

http://cricket.sourceforge.net/support/doc/reference.html

DERIVE

    DERIVE is like COUNTER, but there is no overflow check, so negative
rates are possible. This datasource type would be useful when you have a
count of something (which may increase and decrease), and you want to
graph the rate of change.

    With an rrd-min of zero, the DERIVE datasource type acts like
COUNTER, except that negative samples are treated as unknown. Handling
SNMP COUNTERs in this fashion helps reduce the occurrence of spikes in
the graphs. Negative values can result from restarting the device or
implementation errors in its SNMP agent, and are common enough to really
recommend using DERIVE rather than COUNTER.


I have in my Defaults file --

dataSource --default--
        rrd-ds-type             =   DERIVE
        # if no updates are received for 30 minutes, consider the
datasource
        # unknown -- i.e. dead
        rrd-heartbeat   =       1800
        rrd-min         =       0

--
Marc

-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >>  http://get.splunk.com/