Weird problem with total traffic counts

[Axoft - Yavuz]

I have a weird problem with the total traffic counts. As an example I would like to discuss 1 graph, period between 2008-12-01 and 2009-01-01, however this also applies to other graphs and the period before. The period after I haven't checked before, so I cannot say something specific about this.

Earlier in january 2009 I have created spreadsheets making note of total traffic in+out. For this specific graph my spreadsheet says this port has generated 460 GB of traffic (in+out). However, if I check the graphs now, I see the picture which is attached below (graph_1.png, Yearly 1 day average), which totals about 95 GB of data.

After checking other rra's (by changing the rra_id manually) I can see that the graph looks the same, however the counting of the total's differs.

The most weird part is that my reports, run through reportit, still shows the same value as initial, namely 473 G (I have always had a small difference between my graphs and reportit).

How is this possible and why is reportit still showing a value closer to the initial value shown in the graphs? Can anyone clarify this?

[TheWitness]

Sending a note to the developer responsible for this section of the code.

TheWitness

[ben_c]

I believe this is the same sort of issue to what I am seeing in this thread : http://forums.cacti.net/viewtopic.php?t=27496

My yearly graphs are being averaged heavily, say I had a peak of 100mbit last month, on the yearly graph the max value it displays will be 20mbit. Something very odd with the monthly/yearly graphs.

[TheWitness]

I feel the echo going from post to post.... What does your graph debug look like?

TheWitness

[ben_c]

Hehe, posted in the other thread

[TheWitness]

Oh, S**T, now I have to find it. Need the 0.8.7d debug by the way.

TheWitness

[Axoft - Yavuz]

I have looked over ben_c's thread, and while there are some similarities, there are also differences.

First of all, I am using (and have been using for a fair amount of time) Cacti 0.8.7b. My graph debug is:

RRDTool Command:

/usr/bin/rrdtool graph - \
--imgformat=PNG \
--start=-86400 \
--end=-60 \
--title="sw03.cpl-gfx.axoft.nl - Traffic - 13" \
--rigid \
--base=1000 \
--height=120 \
--width=500 \
--alt-autoscale-max \
--lower-limit=0 \
--vertical-label="bits per second" \
--slope-mode \
--font TITLE:11: \
--font AXIS:8: \
--font LEGEND:6: \
--font UNIT:8: \
DEF:a="/var/www/html/rra/sw03_traffic_in_596.rrd":traffic_in:AVERAGE \
DEF:b="/var/www/html/rra/sw03_traffic_in_596.rrd":traffic_in:MAX \
DEF:c="/var/www/html/rra/sw03_traffic_in_596.rrd":traffic_out:AVERAGE \
DEF:d="/var/www/html/rra/sw03_traffic_in_596.rrd":traffic_out:MAX \
CDEF:cdefa=TIME,1237470794,GT,a,a,UN,0,a,IF,IF,TIME,1237470794,GT,c,c,UN,0,c,IF,IF,+,8,* \
CDEF:cdefe=a,8,* \
CDEF:cdefh=b,8,* \
CDEF:cdefj=c,8,* \
CDEF:cdefbc=d,8,* \
AREA:cdefa#96E78AFF:"Combined" \
GPRINT:cdefa:LAST:"Current\:%8.2lf%s" \
GPRINT:cdefa:AVERAGE:"Average\:%8.2lf%s" \
GPRINT:cdefa:MAX:"Maximum\:%8.2lf%s\n" \
LINE2:cdefe#00CF00FF:"Inbound" \
GPRINT:cdefe:LAST:" Current\:%8.2lf%s" \
GPRINT:cdefe:AVERAGE:"Average\:%8.2lf%s" \
GPRINT:cdefh:MAX:"Maximum\:%8.2lf%s" \
COMMENT:"Total In\: 740.37 MB\n" \
LINE2:cdefj#EACC00FF:"Outbound" \
GPRINT:cdefj:LAST:"Current\:%8.2lf%s" \
GPRINT:cdefj:AVERAGE:"Average\:%8.2lf%s" \
GPRINT:cdefbc:MAX:"Maximum\:%8.2lf%s" \
COMMENT:"Total Out\: 286.97 MB\n" \
COMMENT:"\n" \
HRULE:954774.75#FF0000FF:"95th Percentile" \
COMMENT:"(0.95 mbit in+out)\n"

RRDTool Says:

OK

My concerns are about the counting of the totals on the graphs. As far as I can see I am happy with what I see in the graph, only the legend shows different values, but I may be mistaken.

[TheWitness]

Ping Rony!

TheWitness

[browniebraun]

Hi guys!

Sorry for being late. I received your email forwarded by Reinhard.
From my point of view it would make sense to export the data from the graph view and then to generate a debug file for that time frame with ReportIt. (clone your report, reduce the number of data items to that single one, keep report id in mind and run it again in debug mode. CLI: runtime.php --debug [id] > debug.txt)
Then we can analyse in detail what Cacti and ReportIt are doing and why the calculation results differ.

Best regards
-Andreas-

[Axoft - Yavuz]

Hi there!

php runtime.php --debug 12 gives:

Invalid PHP_SELF Path

php-cgi runtime.php --debug 12 gives an empty output:

X-Powered-By: PHP/5.2.6
Content-type: text/html

Am I doing something wrong? PHP version 5.2.6, reportit version 0.6.1 (I think). Cacti version 0.8.7b.

[browniebraun]

That's a bug within the PIA. Use the full path of runtime.php instead.

Best regards
-Andreas-

[Axoft - Yavuz]

Attached is the debug output of reportit

[browniebraun]

First off... your reporting period is wrong. The end date will be included into the calculation, so you have to setup the reporting period from 2008-12-01 to 2008-12-31!
After that reduce the number of interfaces to your example displayed at the top, so that we can compare the raw data used by ReportIt with that returned by using the csv export button of the graph view.

Best regards
-Andreas-

[Axoft - Yavuz]

Attached!

Created new report with corrected time-frame and only one interface.

[browniebraun]

Till now I did not found any issue within the output of ReportIt, but the csv dump is totally unusable. (e.g. the start and end date represent the start point of unixtime. )
Please try following steps: Go to the yearly graph of that interface and zoom into that graph. Then edit the url and change manually the time frame. Setup parameters as follows:
graph_start=1228003200
graph_end=1230767999

Compare the results of that graph with the results of ReportIt.

Best regards
-Andreas-