CDEF & RPN Expression Function Help

[sonador]

Hello Again with another tricky question

Currently I am using threshold template (thold plugin) with custom CDEF data type for calculating percentage usage of specific network interface.
For devices with 32bit objects I use:

cdef=CURRENT_DATA_SOURCE,8,*,|query_IfSpeed|,/,100,*

For devices with 64bit objects I use:

cdef=CURRENT_DATA_SOURCE,8,*,|query_ifHighSpeed|,1000000,*,/,100,*

This was needed because 10G interfaces get wrongly reported maximum speed through the 32bit ifSpeed object which can only represent maximum value of 2^32-1 or 4294967295, which is approximately 4.3G.

Those two work perfectly well with the complication that I have to keep separate tholds with different templates or custom individual settings for the cdef.

Now because I would like to use one template for all of my devices I would like to go deeper and incorporate both in one cdef using more complex RPN expression with IF operator.
I would like to use one cdef and in the rpn expression I would like to use IF operator to choose which one (|query_IfSpeed|) or (|query_ifHighSpeed|,1000000,*) will use, something like
IF(|query_ifHighSpeed| exist, then return (|query_ifHighSpeed|,1000000,*), else return |query_IfSpeed|)

I have tried following two CDEFs but neither one of them works for me:

cdef=CURRENT_DATA_SOURCE,8,*,|query_ifHighSpeed|,UN,|query_ifSpeed|,|query_ifHighSpeed|,1000000,*,IF,/,100,*
cdef=CURRENT_DATA_SOURCE,8,*,|query_ifHighSpeed|,|query_ifHighSpeed|,1000000,*,|query_ifSpeed|,IF,/,100,*

After spending considerable amount of time on this without any success in making operators work I went further and put a simple cdef to test whether the IF operator works, but again with no success:

cdef=CURRENT_DATA_SOURCE,8,*,1,10000000000,4294967295,IF,/,100,*

All of the last 3 cdefs output current numbers like 71,536,588.8161 for interface with 7% load.

If there is somebody who knows well the RPN syntax and how CDEFs work any help would be highly appreciated!

I really want to find out what am I doing wrong

[gandalf]

For this use case, your approach sounds reasonable.
But to get ifHighSpeed, you will first have to modify the resource/snmp_queries/interface.xml as this does not have the ifHighSpeed by default. Then, there's another issue with systems, that do NOT report an ifHighSpeed as this is not a mandatory MIB.
Are you aware of both those issues?
R.

[sonador]

gandalf yes I am aware. Initially all of my tholds were using CDEF percentage representation from ifSpeed until one day I found that I get wrong alarms for 10G interfaces. Then I started digging and the first thing which I have done, when I found out about ifSpeed vs ifHighSpeed was using the latest interfaces.xml from the svn which has the ifHighSpeed object definition included. Then I created a separate CDEF for the devices which support 64bit objects - all of them in my network are Cisco or Juniper and they all report ifHighSpeed correctly.

The problem with that was that I have to go to each separate threshold edit it and put custom settings on it to use the new CDEF which was representing percentage usage from ifHighSpeed.

I put it for test purposes on couple of interfaces and current numbers in thold were correct.

That was the point where I decided to find a way to make one CDEF for both cases (I want to keep all tholds use the template settings and that was the only way).

From what I read from howtos and tutorials for CDEF and RPN I decided to use UN to check if there is data in |query_ifHighSpeed| which returns TRUE or FALSE and use that as condition argument for IF.

If the result from |query_ifHighSpeed|,UN was TRUE I would return the |query_ifSpeed| because probably the specified device does not support the 64 bit ifHighSpeed, or If result was FALSE I would return |query_ifHighSpeed| converted to bits and that’s how I finally came to the reasonable:

cdef=CURRENT_DATA_SOURCE,8,*,|query_ifHighSpeed|,UN,|query_ifSpeed|,|query_ifHighSpeed|,1000000,*,IF,/,100,*

But it didn’t work. I tried the other two from my first post as well just to make sure operators work but with no success – even with regular IF with numbers for arguments.

Now I am check and mate and cant see what I am doing wrong

[gandalf]

I made some test, using a GPRINT on a normal graph template. The result matches one of your first tests:

Code: Select all

cdef=CURRENT_DATA_SOURCE,8,*,|query_ifHighSpeed|,|query_ifHighSpeed|,1000000,*,|query_ifSpeed|,IF,/,100,*

Adding this to a GPRINT for traffic_out, I received following graph debug on a standard 100 Mbps interface:

Code: Select all

/usr/bin/rrdtool graph - \
--imgformat=PNG \
--start=1323464034 \
--end=1323550434 \
--title='Localhost - Traffic - p3p1' \
--rigid \
--base=1000 \
--height=120 \
--width=700 \
--alt-autoscale \
COMMENT:"From 2011/Dec/09 21\:53\:54 To 2011/Dec/10 21\:53\:54\c" \
COMMENT:"  \n" \
--vertical-label='bits per second' \
--slope-mode \
--font TITLE:12: \
--font AXIS:8: \
--font LEGEND:10: \
--font UNIT:8: \
DEF:a="/home/reinhard/workspace/plugin087h/rra/localhost_traffic_in_1093.rrd":traffic_in:AVERAGE \
DEF:b="/home/reinhard/workspace/plugin087h/rra/localhost_traffic_in_1093.rrd":traffic_out:AVERAGE \
CDEF:cdefa=a,8,* \
CDEF:cdefe=b,8,* \
CDEF:cdefi=b,8,*,100,100,1000000,*,100000000,IF,/,100,* \
AREA:cdefa#00FF0099:"Inbound"  \
GPRINT:cdefa:LAST:" Current\:%8.2lf %s"  \
GPRINT:cdefa:AVERAGE:"Average\:%8.2lf %s"  \
GPRINT:cdefa:MAX:"Maximum\:%8.2lf %s\n"  \
LINE1:cdefe#00A0FFFF:"Outbound"  \
GPRINT:cdefe:LAST:"Current\:%8.2lf %s"  \
GPRINT:cdefe:AVERAGE:"Average\:%8.2lf %s"  \
GPRINT:cdefe:MAX:"Maximum\:%8.2lf %s\n"  \
GPRINT:cdefi:MAX:"Utilization Percentage%8.5lf %%\n" 

Note the "cdefi", which represents the chosen CDEF and the last GPRINT, which prints the data. Find the related screenshot attached.

Not too sure how that fits into THOLD as I'm not used to that
R.

[gandalf]

For devices with 64bit objects I use:

cdef=CURRENT_DATA_SOURCE,8,*,|query_ifHighSpeed|,1000000,*,/,100,*

BTW: In my case, |query_ifHighSpeed| returns valid data even when using 100 Mbps interface only.
But again, I'm not sure what the result would be in case |query_ifHighSpeed| is not available at all (e.g. SNMP V1 devices).
The CDEF may break then, as it would work on strings instead of numbers.
R.

[sonador]

gandalf thank you very much, your post made me look at the graph debug rrd information and here is what I found:

You were right, on device where there is no ifHighSpeed object, cdef breaks:

Code: Select all

RRDTool Command:
/usr/bin/rrdtool graph - \
--imgformat=PNG \
--start=-86400 \
--end=-300 \
--title='zpz-sw-0.varna [1]' \
--rigid \
--base=1000 \
--height=120 \
--width=500 \
--alt-autoscale-max \
--lower-limit=0 \
--vertical-label='bits per second' \
--slope-mode \
--font TITLE:9: \
--font AXIS:7: \
--font LEGEND:8: \
--font UNIT:7: \
DEF:a="/home/www/admin/cacti/rra/zpz-sw-0_varna_traffic_in_1353.rrd":traffic_in:AVERAGE \
DEF:b="/home/www/admin/cacti/rra/zpz-sw-0_varna_traffic_in_1353.rrd":traffic_out:AVERAGE \
CDEF:cdefa=a,8,* \
CDEF:cdefe=b,8,* \
CDEF:cdefi=b,8,*,|query_ifHighSpeed|,UN,10000000,|query_ifHighSpeed|,1000000,*,IF,/,100,* \
AREA:cdefa#00CF00FF:"Inbound"  \
GPRINT:cdefa:LAST:" Current\:%8.2lf %s"  \
GPRINT:cdefa:AVERAGE:"Average\:%8.2lf %s"  \
GPRINT:cdefa:MAX:"Maximum\:%8.2lf %s\n"  \
LINE1:cdefe#002A97FF:"Outbound"  \
GPRINT:cdefe:LAST:"Current\:%8.2lf %s"  \
GPRINT:cdefe:AVERAGE:"Average\:%8.2lf %s"  \
GPRINT:cdefe:MAX:"Maximum\:%8.2lf %s"  \
GPRINT:cdefi:LAST:"Utilization\: %6.2lf%%"  RRDTool Says:
sh: 1: ,1000000,*,IF,/,100,*: not found

On 64bit aware devices at least on all my 64bit aware devices ifHighSpeed is present and both of my test cdefs work fine and when I add them as you suggested as a GPRINT with Percentage as Decimal type to the graph template data is visualized correctly.

This is not the case if I use the same CDEF for interface on 64bit aware device for threshold. In that case I still get the strange numbers for current in the threshold plugin.

I wish there was a RPN operator which I can use against data to test if it’s suitable for CDEF, but since strings break CDEFs and unavailabale queried object is represented as string in the CDEF then my whole idea for combined CDEF is busted

[gandalf]

You were right, on device where there is no ifHighSpeed object, cdef breaks:
...
I wish there was a RPN operator which I can use against data to test if it’s suitable for CDEF, but since strings break CDEFs and unavailabale queried object is represented as string in the CDEF then my whole idea for combined CDEF is busted

So there are two things left:
- The CDEF, that does work on a graph tenplate (at least on 64bit COUNTER aware systems) breaks when used in THOLD
- create a CDEF, that does not break in case ifHighSpeed is not available
Correct?
R.

[TheWitness]

The 'i' release replaces ifhighspeed with ifspeed when ifhighspeed doe not exist. It also does the bits conversion. So in 'i' you should only have to use high speed. We are releasing today.

[gandalf]

The 'i' release replaces ifhighspeed with ifspeed when ifhighspeed doe not exist. It also does the bits conversion. So in 'i' you should only have to use high speed. We are releasing today.

I was not aware of that change. Should read the changelog more often.
But I will spend more time as I'm interested in the general solution. E.g. there may be other use-cases where |query_*| is used on a CDEF and will have to be tested for correct substitution.
R.

[sonador]

The 'i' release replaces ifhighspeed with ifspeed when ifhighspeed doe not exist. It also does the bits conversion. So in 'i' you should only have to use high speed. We are releasing today.

If I get you right, if I use |query_ifHighSpeed| on 'i' release and the object is not available it will be automatically replaced with the ifSpeed value. Is that right?

If that's the case, why do I still receive the following error even after upgrade to 'i' and the |query_ifHighSpeed| is not represented by the |query_ifSpeed| value when the ifHighSpeed object is not available on the specific device:

Code: Select all

  RRDTool Command:

/usr/bin/rrdtool graph - \
--imgformat=PNG \
--start=-86400 \
--end=-300 \
--title='gs-sw-0.varna [1]' \
--rigid \
--base=1000 \
--height=120 \
--width=500 \
--alt-autoscale-max \
--lower-limit=0 \
--vertical-label='bits per second' \
--slope-mode \
--font TITLE:9: \
--font AXIS:7: \
--font LEGEND:8: \
--font UNIT:7: \
DEF:a="/var/www/admin/cacti/rra/gs-sw-0_varna_traffic_in_1499.rrd":traffic_in:AVERAGE \
DEF:b="/var/www/admin/cacti/rra/gs-sw-0_varna_traffic_in_1499.rrd":traffic_out:AVERAGE \
CDEF:cdefa=a,8,* \
CDEF:cdefe=b,8,* \
CDEF:cdefi=b,8,*,|query_ifHighSpeed|,/,100,* \
AREA:cdefa#00CF00FF:"Inbound"  \
GPRINT:cdefa:LAST:" Current\:%8.2lf %s"  \
GPRINT:cdefa:AVERAGE:"Average\:%8.2lf %s"  \
GPRINT:cdefa:MAX:"Maximum\:%8.2lf %s\n"  \
LINE1:cdefe#002A97FF:"Outbound"  \
GPRINT:cdefe:LAST:"Current\:%8.2lf %s"  \
GPRINT:cdefe:AVERAGE:"Average\:%8.2lf %s"  \
GPRINT:cdefe:MAX:"Maximum\:%8.2lf %s"  \
GPRINT:cdefi:LAST:"Utilization\: %6.2lf%%" RRDTool Says:

RRDTool Says:

sh: 1: ,/,100,*: not found

[TheWitness]

Sorry, my bad, it only replaces that value for the 'max' on the rrdfile. So, I was only partially correct. It's an easy enough patch, but we are now done with 0.8.7, so you can make it yourself, but will have to maintain it moving forward.

However, the good thing is that if you make a request (bugs.cacti.net), we can include it in 1.0.