Hello,I created a proof of concept alerting plugin to generate alerts based on Holt Winter information. My intention is creating a plugin that gives the same information as the Holt Winter NfSen extension by Gabor Kiss, but without patching NfSen. It does require patching the RRD files with Holt Winter RRAs, which could also be overcome by manually calculating the Holt Winter information from the nfcapd files. But the Holt Winter RRAs shouldn't pose a problem, and I didn't call a proof of concept for nothing :).
The current NfSen plugin interface doesn't give an option for passing information from the plugin to NfSen (it is not possible to influence the content of the email sent as a result of the alert). So if you configure NfSen to send an e-mail when Holt Winter finds aberrant behavior, the e-mail will only tell that there is aberrant behavior, it will not tell in which profile, source and type of graph (flows, packets or bytes) it is found. To work arround this problem it sends debug information to the syslog, which looks like this:
May 31 15:45:21 [nfsen] holtwinter: found abberant behavior in rrd: /var/lib/nfsen/profiles/live/Trillian.rrd in RRA flows_icmp
The file includes a README file with installation instruction. I created the plugin using nfsen-snapshot-20070312.
All comments or suggestions are welcome! Werner
holtwinter-alert-poc.tar.gz
Description: GNU Zip compressed data
------------------------------------------------------------------------- This SF.net email is sponsored by DB2 Express Download DB2 Express C - the FREE version of DB2 express and take control of your XML. No limits. Just data. Click to get it now. http://sourceforge.net/powerbar/db2/
_______________________________________________ Nfsen-discuss mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
