Traffic - using baseline deviation + high/low value?

[tones]

Hi folks,

We've inherited a Cacti build for traffic monitoring across various routers - Version 0.8.8c using Thold 0.5 - something I'd like to do is set up a template that uses baseline deviation as a base, but then alerts on a fixed minimum value (in bits or bytes). Is this possible? Maybe by modifying the data by RPN Expression? Minimal experience with Cacti or RPN Expressions.

Trying to catch issues with very low traffic following transport events. A threshold breach will occur initially, which is fine, but on restoration would also like to know if any interfaces stay below a set value, say 10,000 (as an aside, do not understand how Cacti calculates its traffic values but that's another thing).

Any ideas here?

[netniV]

First problem you will have is that the version of Cacti you are using is quite old. I'm not sure if the version of THold for 0.8.8 had those capabilities and if so, how far they went.

Certainly, the Cacti 1.1.38 with Thold 1.0.5 would handle that as far as I am aware.

[tones]

First problem you will have is that the version of Cacti you are using is quite old. I'm not sure if the version of THold for 0.8.8 had those capabilities and if so, how far they went.

Certainly, the Cacti 1.1.38 with Thold 1.0.5 would handle that as far as I am aware.

Yeah that's part of the problem - because we now don't have anyone that knows how to work Cacti, it's going to be replaced with something else, so upgrading Cacti isn't likely to happen due to both resources and expertise - but it's what I've got to work with right now

[tones]

The data manipulation options I have are Exact Value, CDEF, Percentage and RPN Expression with:

RPN Expression
An RPN Expression is an RRDtool Compatible RPN Expression. Syntax includes all functions below in addition to both Host and Data Query replacement expressions such as |query_ifSpeed|. To use a Data Source in the RPN Expression, you must use the syntax: |ds:dsname|. For example, |ds:traffic_in| will get the current value of the traffic_in Data Source for the RRDfile(s) associated with the Graph. Any Data Source for a Graph can be included.
Math Operators: +, -, /, *, %, ^
Functions: SIN, COS, TAN, ATAN, SQRT, FLOOR, CEIL, DEG2RAD, RAD2DEG, ABS, EXP, LOG, ATAN, ADNAN
Flow Operators: UN, ISINF, IF, LT, LE, GT, GE, EQ, NE
Comparison Functions: MAX, MIN, INF, NEGINF, NAN, UNKN, COUNT, PREV
Replacement Fields: |query_ifAlias|, |query_ifDescr|, |query_ifHighSpeed|, |query_ifHwAddr|, |query_ifIndex|, |query_ifIP|, |query_ifName|, |query_ifOperStatus|, |query_ifSpeed|, |query_ifType|, |hostname|, |host_id|, |snmp_community|, |snmp_username|, |snmp_password|, |snmp_auth_protocol|, |snmp_priv_passphrase|, |snmp_priv_protocol|, |snmp_context|, |snmp_version|, |snmp_port|, |snmp_timeout|
Data Sources: |ds:traffic_in|, |ds:traffic_out|

[netniV]

Shame you can't try out the newer version of Cacti for your monitoring, in fact our latest development version even has the ability to scan a network range to add devices automatically upon install.

For the purpose of your problem, having thought about this further, I don't think you can get what you are after.

• THold works off the data source value, not the Graph'd value (which is usually converted using a CDEF).
• There are two types of breach value (bv)
  • Min/Lower - value falls equal to or below
  • Max/Upper - value falls equal to or above
• There are two types of breach type (bt)
  • warning
  • error
• There are three types of trigger detection
  • High / Low - Computed value (cv) is the data source value (dsv), not the displayed graph value (which may have been CDEF'd)
  • Deviation - Computed value (cv) is a percentage of change in the data source value (dsv) from over the given time range (tr) of 15m, 1hr, or 4hr. The same deviation is applied to both breach types (bt).
  • Time-based - Computed value (cv) is the data source value (dsv)
• The breach window (bw) may be Never (current event only) or between 1 minute and 1 month.
• The computed value can be manipulated using Data manipulation
• For each breach type (bt), if the breach value (bv) is set and it is found that the computed value (cv) is beyond the breach value (bv) for the breach count (bc) or more over the breach window (bw), the threshold is considered to be triggered
  eg.

  Code: Select all

   foreach (bt) if (bv != null) {
     if (bv is min/lower) && (cv <= bv over bw) threshold triggered
     if (bv is max/upper) && (cv => bv over bw) threshold triggered
  }

[tones]

Shame you can't try out the newer version of Cacti for your monitoring, in fact our latest development version even has the ability to scan a network range to add devices automatically upon install.

For the purpose of your problem, having thought about this further, I don't think you can get what you are after.

Fair enough, thanks for the input! Unfortunately the decision on what we use has already been made by the powers that be :\