Hi Klaas,
You are right pmacct does not do 95th percentile calculations as these
are much better suited to be post-process actions (due to the increased
data visibility they require) than done in-line at the collector layer.
On your question about bits/s. 95th percentile bases on the assumption
you do bucket your data. One min buckets, 5 mins buckets, 1 hour
buckets, etc. You make it a discrete exercise where essentially you say
for those, say, 5 mins that is the amount of bytes accounted for. This
is what pmacct does for you. Then you take the 95th highest measurement
of the buckets within a time frame of choice an hour, a day, a week, a
month, etc. So then let us say you decide to go for 5 mins buckets, you
would just need to do for the winning bucket a "bytes * 8 / 300"
operation to convert bytes to bits (* 8) and then divide by the amount
of seconds in the bucket (/ 300).
Paolo
On 02/11/2020 13:07, Klaas Tammling wrote:
Hi,
this year I'm trying to give pmacct a try for some 95 percentile
calculation. I understood that pmacct doesn't do the calculation by
itself however it can assist in collecting the needed data.
I understood the following:
plugins: pgsql[in], pgsql[out]
sql_table[in]: acct_in
sql_table[out]: acct_out
aggregate[in]: dst_host
aggregate[out]: src_host
sql_history: 1h
sql_history_roundoff: h
By changing sql_history to 5m I can get the 5 minute aggregate of the
received data.
By setting a networks_file (networks_file: ...) I would be able to only
collect data for networks I'm defining in that list.
My question would be now if there is a way to record the bits/s for that
flow for the given timestamp.
Or am I completely wrong with my assumptions?
Thanks very much for any help.
-
Klaas
_______________________________________________
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists
_______________________________________________
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists