Hi - I'm a new subscriber to the list, using ntop in anger for the first
time after years of hand-writing text based tools to do the same job :)
In response to the thread back in June, where Chris Mazuc and Gilles
Mocellin discussed the fact that the RRD databases get a big spike when
ntop restarts... I'm not sure if this message belongs on ntop or
ntop-dev, so I'll leave it here and we can switch if necessary to -dev.
Using a DS of DERIVE instead of COUNTER achieves what you want, I
believe.
The COUNTER data source will make several assumptions about the data it
receives - namely whether the difference between the last data and next
data has wrapped on a 32-bit or 64-bit boundary. Upon restart, the data
being fed into the COUNTER will be drastically lower than the previous
value, and therefore rrdtool will assume that a counter has wrapped.
That assumption means that it then calculates a BIGNUMBER as the value
of the data for that polling interval, and you see what appears to be a
totally outrageous spike.
DERIVE, however, should ignore these overflow checks and will probably
calculate a value of UNKNOWN or zero for the interval where the restart
took place - *as long as* the minimum value for that DS is set to 0.
I have just changed one line in the 3.2 code:
--- ntop-3.2/plugins/rrdPlugin.c 2005-10-04 11:42:28.000000000 +0100
+++ ntop-3.2-patched/plugins/rrdPlugin.c 2007-09-10 17:31:13.000000000
+0100
@@ -1159,7 +1159,7 @@
if(isCounter) {
safe_snprintf(__FILE__, __LINE__, counterStr,
sizeof(counterStr),
- "DS:counter:COUNTER:%d:0:%u", 2*step, topValue);
+ "DS:counter:DERIVE:%d:0:%u", 2*step, topValue);
} else {
/*
Unlimited (sort of)
...and recompiled. Works for me - no silly spikes on restart.
Do you want me to submit a patch, or will you take that one as-is?
Graeme
_______________________________________________
Ntop mailing list
[email protected]
http://listgateway.unipi.it/mailman/listinfo/ntop
