Need help with logging periodic rolling data

[Cylindric]

Greetings again.

I'd like to track some stats on our MailMarshal server, but as it doesn't have SNMP, or any other sort of counters that I can find, I am limited to using the information available in the Message table.

The problem is, I'm not sure conceptually what would be the correct thing to count.

The Message table stores all the messages processed, but only for the last 3 months (rolling). The table contains fields such as TimeLogged, MessageSize, Classification, etc.

What are my options for pulling this sort of data into Cacti? I can create a query that will return something like "messages per day"

2009-05-15 43,213
2009-05-16 42,257
2009-05-17 44,456
2009-05-18 32,533
2009-05-19 43,764

Or maybe just "messages in the last X time-frame"
InLastHour:1533 InLastDay:44456

Obviously if I create a counter like the second example, graphs can't just add them all up, as a five-minute polling wouldn't make sense.

Also, just doing a count(*) wouldn't work as a "GUAGE", as it doesn't ever-increase, but nor does it increase-then-reset. It'll probably just hover around a similar number.

I apologise for the confusing question, but I can't quite get my head around it

[BSOD2600]

Or maybe just "messages in the last X time-frame"
InLastHour:1533 InLastDay:44456

Since cacti polls every 5 min (be default), a query that would return the number of messages in the last 5 minutes could be useful. It should increase/decrease throughout the day, I'd imagine.

Also, just doing a count(*) wouldn't work as a "GUAGE", as it doesn't ever-increase, but nor does it increase-then-reset. It'll probably just hover around a similar number.

I think this would also be ok. You could establish a baseline and then be able to easily see deviations over time. Additionally, once again since cacti polls every 5 min and at least with default rrd settings, you have this granular history for a few days. Then you could possibly use some CDEF magic to find the difference between the current value and the previous (sort of like your first suggestion of 'last 5 minutes').