Thold report wrong values

[ahiyaz]

hello community members
hope you all feel well.

i an issue with the tholed plugin, I cant understand if it a bug or missconfiguration
ive configured a high traffic threshold on one of my traffic graphs.
im using cacti 1.2.7 with spine.

usually, the threshold traffic reading are correct, but from time to time i get alerts with really wrong values
checking the graph values at the same time and I see that they don't match the threshold values

for example:

fw01 2020-03-23 11:00:18 High / Low NORMAL: fw01 - Traffic - 82.166.23.205 - port27 [traffic_out] Restored to Normal Threshold with Value 234.89 M N/A 234.89 M
fw01 2020-03-23 10:41:20 High / Low ALERT: fw01 - Traffic - 82.166.23.205 - port27 [traffic_out] went above threshold of 250.00 M with 815.89 M 250.00 M 815.89 M
fw01 2020-03-23 08:23:19 High / Low NORMAL: fw01 - Traffic - 82.166.23.205 - port27 [traffic_out] Restored to Normal Threshold with Value 208.17 M N/A 208.17 M
fw01 2020-03-23 08:16:19 High / Low ALERT: fw01 - Traffic - 82.166.23.205 - port27 [traffic_out] went above threshold of 250.00 M with 775.28 M 250.00 M 775.28 M
fw01 2020-03-21 13:31:19 High / Low NORMAL: fw01 - Traffic - 82.166.23.205 - port27 [traffic_out] Restored to Normal Threshold with Value 113.36 M N/A 113.36 M


you can see from thold log values of 815.89 and 775.28 while the graph pulled values are different

2020-03-23 10:41:00 9 M 9 M 9 M 97 M 97 M -101591310.12 9 M -101591310.12
2020-03-23 08:16:00 3 M 3 M 3 M 93 M 93 M -97022313.76 3 M -97022313.76


I've attached thold config and graph template config

[Ben94x]

Hi ahiyaz,

Did you try to change your timezone on your Cacti server and your php.ini ?
I have similar issues with my Cacti v1.2.8 too... I had negatives values in both traffic (traffic_in and traffic_out), so I changed my php.ini timezone to America/Montreal and my traffic_in is now with the right value. I still have a problem with my traffic_out (always negative), but at least my traffic_in is correct.

I posted my problem in this post: viewtopic.php?f=17&t=59382

Here is my problem

Cacti_threshold.png (95.12 KiB) Viewed 5245 times

Cacti_config_threshold1.png (67.62 KiB) Viewed 5243 times

cacti_config_threshold2.png (62.85 KiB) Viewed 5245 times

If you found the problem or if someone can help me, post the solution here please.

Best regards,
Ben

[Osiris]

There is an issue/feature in thold right now that the data reflected in the forms needs to be the raw data from the RRDfile. In the RRDfile, the data that is saved is in OCTETS/Bytes. So, even though your graph is in bps, you need to enter your thresholds as Bps. Just hover/read the tip (question mark) on the min and max values for a hint.

[Ben94x]

There is an issue/feature in thold right now that the data reflected in the forms needs to be the raw data from the RRDfile. In the RRDfile, the data that is saved is in OCTETS/Bytes. So, even though your graph is in bps, you need to enter your thresholds as Bps. Just hover/read the tip (question mark) on the min and max values for a hint.

I already did, as you can see my min and max value (WHi : 120 M and AHi : 150 M) , but how and where I can change my current value to get the right value it suppose to be ?

[Osiris]

What version of Cacti? If using 1.2.10 or 1.2.9, update the poller_boost.php and lib/boost.php from the 1.2.x branch. Those gaps will be fixed by that update. Once you are fixed up, then see if the number right size. There should not be any 'negative' bandwidth values. Very odd.

[Ben94x]

What version of Cacti? If using 1.2.10 or 1.2.9, update the poller_boost.php and lib/boost.php from the 1.2.x branch. Those gaps will be fixed by that update. Once you are fixed up, then see if the number right size. There should not be any 'negative' bandwidth values. Very odd.

I'm using cacti v1.2.8, should I upgrade it to 1.2.10 ? If yes, where can I find the informations to do it properly ?

Thanks,
Ben

[Osiris]

Wait for 1.2.11. Just a few days away.

[ahiyaz]

so I should just deviate the threshold value by 8? ill try that
are there any known issues with my cacti ver (1.2.7) regarding tholed (thold ver 1.3.2)

thanks

[ahiyaz]

by the way, it is still a negative value.
i had to configure the threshold as negative
this is how the threshold config looks like if i put a positive value




traffic_in
Last:5.25 MAHi:120.00 Mtraffic_in
Last:5.25 MAHi:31.25 Mtraffic_out
Last:10.83 MAHi:120.00 Mtraffic_out
Last:-1.35 MAHi:-31.25 Mnew thold
n/a

[ahiyaz]

hi

I've changed the threshold into Bytes
but still, the alerts have nothing to do with the graph values


thresholds log

fw01 2020-03-30 05:09:19 High / Low ALERT: fw01 - Traffic - 82.166.23.205 - port27 [traffic_out] went above threshold of 31.25 M with 169.26 M

traffic values from the graph

2020-03-30 05:09:00 819 K 819 K 819 K 20 M 20 M -21163792.167 819 K -21163792.167

I've tried to find a guide of how to configure traffic tholde but couldn't find it.

appreciate your help

thanks

[ahiyaz]

ive try to work with CDEFs and i configure this one --> cdef=CURRENT_DATA_SOURCE,8,*,100,*,1000000000,/
this supposes to convert the Octats value you get when querying the interface BW OID into bits.
still couldn't make it work

[Ben94x]

With the new version it worked, I have now the good values for my thresholds with Cacti v1.2.11.

Like TheWitness (a dev for Cacti) said to me...

If not using debian, the upgrade, from my perspective is pretty easy with no loss of data:

Just try that:

As root**

cd /var/www/html
git clone -b 1.2.x https://github.com/Cacti/cacti.git cacti-develop
/bin/cp -frp cacti-develop/* cacti
chown -R apache:apache cacti

Then, refresh your browser to go through the update if you are using the Debian packaging, it's a bit more complicated.

[ahiyaz]

thanks for the update!!!!
ill try that

[ahiyaz]

"If not using debian, the upgrade, from my perspective is pretty easy with no loss of data"
so is it true regarding ubuntu or the upgrade could work?

[Ben94x]

"If not using debian, the upgrade, from my perspective is pretty easy with no loss of data"
so is it true regarding ubuntu or the upgrade could work?

The upgrade gonna work fine