graphing data from a text file

[reticent]

Hi Guys,

I have some data which is stored locally in a plain text file, in the following format:

8080:3730240:34951534
80:1149806:19734408
443:1043746:9314918
25:114124:5772
1102882

the first part represents a port number, the second sent bytes, and the third recieved bytes. I'm wanting to graph this information so I can see traffic trends within our network (it will also allow me to spot any anomolies, ie large amounts of inbound traffic suggesting a ddos). Do I need to write some sort of a custom script to do this or does cacti have something built in?

The file updates every 5minutes, and preferably I'd want one graph for each port number, with a line for sent and a line for recieved on each graph. Can someone point me in the right direction?

Cheers,

Stew

[kuma3]

Here's how we get metric in our env, others might have better way.

The format you need is one long line of space separated entries of $metric:$value. In your case, you would do something like this:

8080_rcv:3730240 8080_snt:3730240 80_rcv:1149806 80_snt:19734408 [you get the idea]

Then define a data input method for script/command to get the line. Define outputs for the input method as 8080_rcv, 8080_snt, 80_snt...etc. Then define data templates to use those outputs. Then define a graph template to use the data template and then add the graph template to host.

That should be it.

[reticent]

Thanks, I've reformatted the output to conform with what you've suggested. I've created the data input, the data template, and the graph template and aren't having too much luck. http://cacti.net/downloads/docs/html/da ... thods.html is pretty unclear. Is there anyway of finding out whether the data input query is actually working part way through this process?

I'm just using the below as a test:

80_rcv:1549901 80_snt:18574511

I created 80_rcv, and 80_snt as the output fields. The script I get cacti to run looks like:

echo "80_rcv:1549901 80_snt:18574511";

are there any decent guides available?

[kuma3]

try this one, pretty comprehensive.

http://docs.cacti.net/node/46

[reticent]

unfortunately it only deals with single data sources :\

[TheWitness]

This is pretty easy. You fist create a data input method that takes the "Port" as the input parameter. Then you write a PHP script (I like script server cause it is very fast), to read the file, explode it into an array delimited by ":", and then search for the port number and return the values.

It's actually quite easy. To read the file you use the PHP "file" command. Each line of the file will become a member of an array. Then you use the php "explode" command that will take all values delimited with whatever, you your case ":" and create another array. So it looks something like this.

Code: Select all

$file_array = file("/myfile.txt");

if (sizeof($file_array)) {
foreach($file_array as $line) {
  $values = explode($line, ":"); # check the order on this one
  if ($values[0] == $my_port) {
    print (or return) "BytesIn:" . $values[1] . " BytesOut:" . $values[2];
    break; # if using print
  }
}
}

You will have to add more to this to make it a script server script. You can also make the file name an input parameter to allow you to extend this even further. But hopefully, you get the idea.

TheWitness

[reticent]

thanks. Is there any advantage to doint it that way rather than just having all the output one one line with the data sources defined? I have it half working with the original script. It seems to graph the first part, the recieved bytes but not the sent. Attached are each of the 3 components, is there anything obviously wrong?

[gandalf]

Larry's approach is a bit more general. You may make up a Data Query using this to select specific ports from a list, if you want. You you may apply this same Data Query to different host and choose different sets of port to monitor.
You plain script approach is fine as well. But if ports change or new ports appear, you will have to change
- the script
- create a new Data Template (because you can't add new data items to an existing rrd file!)
- create new Graph Template(s)
If you assume the list of ports to be constant, your approach will work fine, for sure.
All of this is documented in detail at the first link of my signature.
Reinhard

[TheWitness]

Here are a few hints:

[reticent]

Thanks for the hints I've converted over to the PHP script and it seems to be working similar to the last. For some reason the sent bytes still isn't working...see the attached for the 'nans'.

gateway:/home/stew# ./ports.php 80
bytes_in:549021 bytes_out:2550595

Any ideas?

[reticent]

hold that, I've been fiddling and it's come right. I think it might have been the 'maximum' value field on one of the input sources. It was set to 100 as default which probably was causing problems given the value is always 100+.

Thanks heaps for your help guys, you've made a great application.