Absolute instead of Average

[yogitauppal]

Hi ALL,

I am trying to change the thold function. the user doesn't want to see the Average traffic but the real traffic.

But If I am using the Baseline functionality then it will be taking average of last 30 minute or 1 hr.

Please suggest how can I change the thold_function.php file to get the desired output or if by another way I can get the desired values.

Thanks in Advance

[noname]

I am trying to change the thold function. the user doesn't want to see the Average traffic but the real traffic.

What means "real" ? (MAX instead of AVERAGE ?)

Please suggest how can I change the thold_function.php file to get the desired output or if by another way I can get the desired values.

If you want fiddle graph which is attached to alerting mail, for example..
This is default code of thold_functions.php (0.4.4-43):

Code: Select all

function thold_mail(...) {
	...
	$graph_data_array = array('output_flag'=> RRDTOOL_OUTPUT_STDOUT);
	$data = png2jpeg(rrdtool_function_graph($val['local_graph_id'], $val['rra_id'], $graph_data_array));
	...

1) Change graph RRA

$data = png2jpeg(rrdtool_function_graph($val['local_graph_id'], 5, $graph_data_array));

"5" means "Hourly" (in most cases -- see "Data Sources->RRAs").
But the datasource which given threshold refers should include that RRA (=Hourly) in its data template.

2) Change graph timespan more narrower

Add a line like this:

$graph_data_array = array('graph_start'=> "end-3h");

You can set timespan (in this case, 3 hours) as you like.

But radically, I think it's not so different with the present situation... :P

[yogitauppal]

Hi,
to explain the issue a bit more clearly. We have applied thresholds to the traffic in and out .. screenshot for the same is attached.Instead of 30 minute average or 1 hour average, we ewant the alarm to be generated on real value instead of average value.

[noname]

Hmm,
you want "an actual value at 30 minutes before" instead of "average for 30 minutes past" ?

If so, probably can't.
Because baseline monitoring get a value which was stored in upper RRA (Daily < Weekly < Monthly < Yearly) in order to comprare with current one.
That is already consolidated value. Thold plugin (0.4.4 and later?) won't re-calculate averages when checking thresholds (for the purpose of reducing processing time).

So it's not "real" value.

[yogitauppal]

is it possible to make changes in code to make this possible

[noname]

Probably changing code doesn't help you -- because "real" value in the past isn't stored in RRD file.

If you modify all RRAs to store with the same resolution as Daily (=1 step), maybe "AVERAGE" will not be averaged value.
But that way is redundant, wastes your disks, and require you to re-create all datasources (and graphs)... I never recommend it.