Helo Werner, Werner Schram wrote: > Hi Chelo, > > Chelo Malagon wrote: > >> Hello, >> I installed Gabor's hw plugin on nfsen (last snapshot 20070808) and I am >> detecting some problems. >> The first of all is that the URL in the alert mail is incorrect . If I >> click on it I get a message in the navigator saying "WARNING: Bookmark >> processing error!" >> The URLI receive in the mail has this form: >> >> http://mymachine.es/nfsen/nfsen.php/nfsen.php?bookmark=MnwwfC4vbGl2ZXxMYXNQYWxtYXMwfFRDUHxmbG93c3wxfDExODcwODA4MDB8MTE4NzA4MDgwMHwxMTg3MDgwODAwf >> >> > There is a field missing in the bookmark creation code. You can fix this > by replacing this: > > my $bookmark = join('|', > 2,0,"./$profile", > $bm_channel,$bm_proto,$bm_type,1, > $bm_tend,$bm_tleft,$bm_tright, > 0,1,0 > ); > > with this: > > my $bookmark = join('|', > 2,'-',"./$profile", > $bm_channel,$bm_proto,$bm_type,1,1, > $bm_tend,$bm_tleft,$bm_tright, > 0,1,0 > ); >
thanks. that solves the problem. another question: Once I have changed the code and the URL is cortrect, the mail i received says that the anomaly is found in the timeslot 200708161255, but when you press in the link the navigator show you the graphics pointed out another timeslot (5 mins before 200708161250). >> On the other hand, I tried the hw extension (working in cooperation with >> the nfsen instance) some months ago, and I have the feeling the plugin >> detects more aberrant behavior than the hw extension did. (I am >> receiving an alert every 5 mins) . >> > The patch and the plugin use the rrdtool implementation of Holt-Winters. > Are you sure that you have used the same parameters for rrd_hwreapply? > Because with the same parameters, it should behave the same. > Yes. In fact I used the same parameters specified in the README-HW file in the hw extension. >> Maybe it's a perception, but >> analyzing the alerts I receive now I can't see real incidents, but just >> minimal deviations or peaks that shouldn't have been taken into account. >> Is there a way to avoid this? because I have the feeling the plugin is >> too sensitive. >> >> > The --window-length, --failure-threshold, --deltapos, --deltaneg and the > --delta parameters can be used to tune this. The algorithm will trigger > when `--failure-threshold` events have been detected during the last > `--window-length` timeframes (so with the default parameters, it will > trigger if 6 hw-events happen in 9 timeframes). The '--delta' parameters > multiply the expected deviation (so the algorithm will be less likely to > trigger). > >> The plugin have been running for 2 days now (I remember from the HW >> extension that it began to detect aberrant activity after a week of >> being running. If the algorithm is still the same the behavior of the >> current plugin should be the same, right?). >> >> Just for info, I generated the rrds using rrd_hwrepplay and this params: >> >> --default --deltapos=5 --deltaneg=10 --season=288 --rralen=1440 >> >> > Well, it should start working directly after you have run rrd_hwreapply > and started the plugin. But the quality of the estimates should increase > the first few weeks. > Thanks for the explanation. I am going to monitored its behavior for some days now and trying to play with the parameters to tune it. Chelo > Werner > >> Regarding the new snapshot, I can't select a single timeslot in the >> details page. The tstart and tend is always set to the value "update". I >> can's see the box that used to show you the current selected timeslot >> in the graph. Now the only way to select a different timeslot is using >> the bottoms under the graph. >> >> Thanks in advance >> Chelo >> >> >> >> >> >> > > > ------------------------------------------------------------------------- > This SF.net email is sponsored by: Splunk Inc. > Still grepping through log files to find problems? Stop. > Now Search log events and configuration files using AJAX and a browser. > Download your FREE copy of Splunk now >> http://get.splunk.com/ > _______________________________________________ > Nfsen-discuss mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/nfsen-discuss > > > -- "Se puede admitir la fuerza bruta, pero la razón bruta es insoportable.". Oscar Wilde ------------------------------------------------------------------------- This SF.net email is sponsored by: Splunk Inc. Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> http://get.splunk.com/ _______________________________________________ Nfsen-discuss mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
