>
>I know nfsen can't generate historic shadow profiles which produces RRDs
>for its graphs, so it must be doable somehow but I can't figure it out!
You mean Œcan¹ here, surely? nfdump can generate RRDs for a shadow profile
(which is an nfdump filter applied to historical data)
>I would like to be able to generate an RRD from a given nfdump filter
Well, making an assumption that you have an RRD pre-created with a single
DS taken to accept the bps given from a particular nfdump filter at any
point in time I.e:
$ rrdtool create foo.rrd DS:bps:COUNTER:600:U:12500000
RRA:AVERAGE:0.5:1:600 RRA:MAX:0.5:1:600
you could do something like this every five minutes:
$ rrdtool update test.rrd N:`nfdump -q -N -M
/usr/local/nfsen/profiles/live/8426 -T -r nfcapd.201501042240 -n 10 -s
srcip/bytes 'host 8.8.8.8' | awk '{ print $11 }'`
(in this example, the summarised bps from all traffic sourced from 8.8.8.8
would be added to the RRD with the current timestamp)
Dave.
