hi John,
would you like to keep the iostat data for longer time frames in memory
more and use the last 10 minutes data for reporting, or would you
actually prefer to keep iostat trimmed to last 10 minutes?
If you would like to follow the second approach, you could employ a
second context for data management which would contain time information
as David suggested.
For example, the following action list looks similar to the vmstat
example from your mail, but just harnesses two contexts for handling
each iostat input stream:
type=single
ptype=regexp
pattern=iostat\[(\d+)\]:
desc=process iostat data
action=add $1_iostat_data $0; \
add $1_iostat_times %u; \
lcall %tlim %u -> ( sub { $_[0] - 10 } ); \
assign %prune 1; while %prune ( \
shift $1_iostat_times %oldest; \
lcall %prune %oldest %tlim -> ( sub { $_[0] < $_[1] } ); \
if %prune ( shift $1_iostat_data %discard ) \
else ( prepend $1_iostat_times %oldest; break; ) )
Would this example address the problem at hand?
kind regards,
risto
On 08/23/2013 12:36 AM, John P. Rouillard wrote:
>
> In message<alpine.deb.2.02.1308221357240.12...@nftneq.ynat.uz>,
> David Lang writes:
>
>> On Thu, 22 Aug 2013, John P. Rouillard wrote:
>>> In trying to troubleshoot a problem with an application, I want to
>>> include the prior 10 minutes of iostat info along with the report. I
>>> have the rules to detect the problem in the application but I am not
>>> sure how to capture/report the last 10 minutes of iostat info.
>>>
>>> When I was working with single line vmstat info, I could use this
>>> little action snippet:
>>>
>>> action = add $1_vmstat_data $0 ; \
>>> getsize %size $1_vmstat_data; \
>>> lcall %gt10 %size -> ( sub { $_[0]> 10 } ); \
>>> while %gt10 ( shift $1_vmstat_data %discard; \
>>> getsize %size $1_vmstat_data; \
>>> lcall %gt10 %size -> ( sub { $_[0]> 10 } ); \
>>> ) ;
>>>
>>> to trim the _vmstat_data down to just 10 lines. Since I am shifting
>>> off the old data and adding the new data I get the last 10 minutes.
>>>
>>> I would like to do the same with the iostat data, but it's multiline
>>> data and I don't know how many lines will be in the data (it depends
>>> on the command line values, how many disks are on the servers etc). I
>>> know each report will start with the "avg-cpu:" header line (but a
>>> different pid).
>> I would be looking to limit based on time instead of number of events.
>> Something like 'report the last 10 minutes of iostat' rather than
>> 'report the last 10 iostat sets of output'.
>
> That would work as well.
>
>> I'd have to go back through my saved mail or the list archives, but I
>> seem to remember a recent discussion on how to do a time-based limit
>> like this.
>
> Maybe something with EventGroup??
>
> --
> -- rouilj
> John Rouillard
> ===========================================================================
> My employers don't acknowledge my existence much less my opinions.
>
> ------------------------------------------------------------------------------
> Introducing Performance Central, a new site from SourceForge and
> AppDynamics. Performance Central is your source for news, insights,
> analysis and resources for efficient Application Performance Management.
> Visit us today!
> http://pubads.g.doubleclick.net/gampad/clk?id=48897511&iu=/4140/ostg.clktrk
> _______________________________________________
> Simple-evcorr-users mailing list
> Simple-evcorr-users@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
>
------------------------------------------------------------------------------
Introducing Performance Central, a new site from SourceForge and
AppDynamics. Performance Central is your source for news, insights,
analysis and resources for efficient Application Performance Management.
Visit us today!
http://pubads.g.doubleclick.net/gampad/clk?id=48897511&iu=/4140/ostg.clktrk
_______________________________________________
Simple-evcorr-users mailing list
Simple-evcorr-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
