Interesting point... I don't like recompiling, so I'll wait until I upgrade and play with this "feature"...
Thanks! Gary -----Original Message----- From: [email protected] [mailto:[email protected]] On Behalf Of Graeme Fowler Sent: Monday, March 02, 2009 3:47 PM To: [email protected] Subject: Re: [Ntop] rrd graphs misleading (stacked instead of overlayed) On Mon, 2009-03-02 at 12:24 -0600, Gary Gatten wrote: > Some / many graphs (rrd) are misleading as they are "stacked" instead > of "overlayed" For example: <snip> > Has anyone else noticed this and is there a fix? I wouldn't say this is a bug (I know you're not!), it's more of a feature. Imagine you had 20 different protocol data sets on the same graph (not inconceivable considering your followup graph has 19!). Imagine that they generally run within 5-10% of each other in terms of throughput (ie. roughly 5% each of the total traffic). You'd be hard pressed to separate them; the dominant line would be the last defined one (in your case, WinMX would overdraw the others) and the throughput on the Y axis would not reflect the true, combined throughput. In RRDTool terms, using STACK instead of LINE[12] or AREA allows the full combination of the data to be shown (as long as the dataset includes all the data, obviously) and means you can see graphically which of the protocols contributes most at any given time. In my experience, using STACK alongside an overview graph allows the same data to be shown at the same scale, with the obvious contributors standing out. Using LINE[12] or AREA means the dominant colour *or* the last dataset stand out, which can be confusing for large sets of data (like yours). If you're willing to recompile I bet you could find the bit in the source that does STACK and change it to AREA. Then you'll get some *really* misleading graphs! Graeme _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font> _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop
