Rick Jones wrote: >First a "style" question I suppose. Let's say for the sake of argument >I decided to write my own "take sFlow counters and shove them into an >RRD" program. Each interface has a number of counters. One can specify >more than one DS per RRD but it seems that ntop for example has decided >to create one per stat: > >root@tardy:/usr/local/var/ntop/rrd/interfaces/sFlow-device.2/sFlow/45# >ll >total 2628 >drwx------ 2 root root 4096 2011-04-12 11:34 ./ >drwx------ 54 root root 4096 2011-04-08 15:50 ../ >-rw------- 1 root root 59968 2011-04-15 15:57 ifInBroadcastPkts.rrd >-rw------- 1 root root 59968 2011-04-08 16:07 ifInDiscards.rrd >-rw------- 1 root root 59968 2011-04-20 11:06 ifInMulticastPkts.rrd >-rw------- 1 root root 59968 2011-04-20 11:06 ifInOctets.rrd >-rw------- 1 root root 2126656 2011-04-20 11:06 ifInUcastPkts.rrd >-rw------- 1 root root 59968 2011-04-20 11:06 ifOutBroadcastPkts.rrd >-rw------- 1 root root 59968 2011-04-20 11:06 ifOutDiscards.rrd >-rw------- 1 root root 59968 2011-04-20 11:06 ifOutMulticastPkts.rrd >-rw------- 1 root root 59968 2011-04-20 11:06 ifOutOctets.rrd >-rw------- 1 root root 59968 2011-04-20 11:06 ifOutUcastPkts.rrd > >Before I simply, blithely mimic that, is there any best practice?
It's largely a matter of what suits your situation. Where there is a likelyhood of the number of datasets changing then you are better off with separate files. An example of that would be monitoring disk space where you may add or remove a filesystem. In that case you'd probably want one file per filesystem. On the other hand, for an ethernet interface, I'd have combined those separate files into one since the set of values being logged isn't likely to change. Another factor is whether all the data values are going to be available at the same time. You cannot do a partial update - so you cannot update one dataset at one point in time, and another at a different time, when they are in the same RRD file. If you can collect all the data values at once (which would be the case with an ethernet interface), then it's one call to update them all rather than updating each separate file individually. >Also, when creating with --no-overwrite, what happens if the second or >Nth create has a different value for things like step or heartbeat? Are >they simply ignored or does some sort of "conversion" take-place? If you don't overwrite the file, then nothing gets changed. >Looking at the output of rrdtool dump on one of those RRDs above, am I >correct in assuming that when apart from perhaps the >forcasting/specialized RRAs all RRAs are derived from Primary Data >Points and don't "cascade?" Correct. I believe the way it works is that each RRA has it's own accumulator, and as each primary 'bucket' is completed, the accumulator for each RRA is updated with the value in the bucket. As each consolidated time period is completed, then a new consolidated data point is generated. You can easily see that the consolidations aren't always cascadable since you could (for example) you could consolidate over 5 and 12 minute periods which only coincide once an hour. -- Simon Hobson Visit http://www.magpiesnestpublishing.co.uk/ for books by acclaimed author Gladys Hobson. Novels - poetry - short stories - ideal as Christmas stocking fillers. Some available as e-books. _______________________________________________ rrd-users mailing list rrd-users@lists.oetiker.ch https://lists.oetiker.ch/cgi-bin/listinfo/rrd-users
