Hi Chelo,
Chelo Malagon wrote:
> Hello,
> I installed Gabor's hw plugin on nfsen (last snapshot 20070808) and I am
> detecting some problems.
> The first of all is that the URL in the alert mail is incorrect . If I
> click on it I get a message in the navigator saying "WARNING: Bookmark
> processing error!"
> The URLI receive in the mail has this form:
>
> http://mymachine.es/nfsen/nfsen.php/nfsen.php?bookmark=MnwwfC4vbGl2ZXxMYXNQYWxtYXMwfFRDUHxmbG93c3wxfDExODcwODA4MDB8MTE4NzA4MDgwMHwxMTg3MDgwODAwf
>
There is a field missing in the bookmark creation code. You can fix this
by replacing this:
my $bookmark = join('|',
2,0,"./$profile",
$bm_channel,$bm_proto,$bm_type,1,
$bm_tend,$bm_tleft,$bm_tright,
0,1,0
);
with this:
my $bookmark = join('|',
2,'-',"./$profile",
$bm_channel,$bm_proto,$bm_type,1,1,
$bm_tend,$bm_tleft,$bm_tright,
0,1,0
);
> On the other hand, I tried the hw extension (working in cooperation with
> the nfsen instance) some months ago, and I have the feeling the plugin
> detects more aberrant behavior than the hw extension did. (I am
> receiving an alert every 5 mins) .
The patch and the plugin use the rrdtool implementation of Holt-Winters.
Are you sure that you have used the same parameters for rrd_hwreapply?
Because with the same parameters, it should behave the same.
> Maybe it's a perception, but
> analyzing the alerts I receive now I can't see real incidents, but just
> minimal deviations or peaks that shouldn't have been taken into account.
> Is there a way to avoid this? because I have the feeling the plugin is
> too sensitive.
>
The --window-length, --failure-threshold, --deltapos, --deltaneg and the
--delta parameters can be used to tune this. The algorithm will trigger
when `--failure-threshold` events have been detected during the last
`--window-length` timeframes (so with the default parameters, it will
trigger if 6 hw-events happen in 9 timeframes). The '--delta' parameters
multiply the expected deviation (so the algorithm will be less likely to
trigger).
> The plugin have been running for 2 days now (I remember from the HW
> extension that it began to detect aberrant activity after a week of
> being running. If the algorithm is still the same the behavior of the
> current plugin should be the same, right?).
>
> Just for info, I generated the rrds using rrd_hwrepplay and this params:
>
> --default --deltapos=5 --deltaneg=10 --season=288 --rralen=1440
>
Well, it should start working directly after you have run rrd_hwreapply
and started the plugin. But the quality of the estimates should increase
the first few weeks.
Werner
> Regarding the new snapshot, I can't select a single timeslot in the
> details page. The tstart and tend is always set to the value "update". I
> can's see the box that used to show you the current selected timeslot
> in the graph. Now the only way to select a different timeslot is using
> the bottoms under the graph.
>
> Thanks in advance
> Chelo
>
>
>
>
>
-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
Nfsen-discuss mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
