Cacti (home)ForumsDocumentation
Cacti: offical forums and support
It is currently Fri Sep 21, 2018 7:10 am

All times are UTC - 5 hours




Post new topic Reply to topic  [ 6 posts ] 
Author Message
 Post subject: Traffic - using baseline deviation + high/low value?
PostPosted: Thu Sep 13, 2018 3:07 pm 
Offline

Joined: Thu Sep 13, 2018 2:48 pm
Posts: 4
Hi folks,

We've inherited a Cacti build for traffic monitoring across various routers - Version 0.8.8c using Thold 0.5 - something I'd like to do is set up a template that uses baseline deviation as a base, but then alerts on a fixed minimum value (in bits or bytes). Is this possible? Maybe by modifying the data by RPN Expression? Minimal experience with Cacti or RPN Expressions.

Trying to catch issues with very low traffic following transport events. A threshold breach will occur initially, which is fine, but on restoration would also like to know if any interfaces stay below a set value, say 10,000 (as an aside, do not understand how Cacti calculates its traffic values but that's another thing).

Any ideas here?


Top
 Profile  
 
 Post subject: Re: Traffic - using baseline deviation + high/low value?
PostPosted: Thu Sep 13, 2018 5:36 pm 
Offline
Cacti Guru User

Joined: Sun Aug 27, 2017 12:05 am
Posts: 1435
First problem you will have is that the version of Cacti you are using is quite old. I'm not sure if the version of THold for 0.8.8 had those capabilities and if so, how far they went.

Certainly, the Cacti 1.1.38 with Thold 1.0.5 would handle that as far as I am aware.

_________________
Cacti Resources:
Cacti Website
Cacti Issues
Cacti Releases

My resources:
How to submit Pull Requests
Development Wiki and How To's
Updated NetSNMP Memory template for Cacti 1.x
Cisco SFP template for Cacti 0.8.8


Top
 Profile  
 
 Post subject: Re: Traffic - using baseline deviation + high/low value?
PostPosted: Thu Sep 13, 2018 9:08 pm 
Offline

Joined: Thu Sep 13, 2018 2:48 pm
Posts: 4
netniV wrote:
First problem you will have is that the version of Cacti you are using is quite old. I'm not sure if the version of THold for 0.8.8 had those capabilities and if so, how far they went.

Certainly, the Cacti 1.1.38 with Thold 1.0.5 would handle that as far as I am aware.


Yeah that's part of the problem - because we now don't have anyone that knows how to work Cacti, it's going to be replaced with something else, so upgrading Cacti isn't likely to happen due to both resources and expertise - but it's what I've got to work with right now :(


Top
 Profile  
 
 Post subject: Re: Traffic - using baseline deviation + high/low value?
PostPosted: Thu Sep 13, 2018 9:22 pm 
Offline

Joined: Thu Sep 13, 2018 2:48 pm
Posts: 4
The data manipulation options I have are Exact Value, CDEF, Percentage and RPN Expression with:

RPN Expression
An RPN Expression is an RRDtool Compatible RPN Expression. Syntax includes all functions below in addition to both Host and Data Query replacement expressions such as |query_ifSpeed|. To use a Data Source in the RPN Expression, you must use the syntax: |ds:dsname|. For example, |ds:traffic_in| will get the current value of the traffic_in Data Source for the RRDfile(s) associated with the Graph. Any Data Source for a Graph can be included.
Math Operators: +, -, /, *, %, ^
Functions: SIN, COS, TAN, ATAN, SQRT, FLOOR, CEIL, DEG2RAD, RAD2DEG, ABS, EXP, LOG, ATAN, ADNAN
Flow Operators: UN, ISINF, IF, LT, LE, GT, GE, EQ, NE
Comparison Functions: MAX, MIN, INF, NEGINF, NAN, UNKN, COUNT, PREV
Replacement Fields: |query_ifAlias|, |query_ifDescr|, |query_ifHighSpeed|, |query_ifHwAddr|, |query_ifIndex|, |query_ifIP|, |query_ifName|, |query_ifOperStatus|, |query_ifSpeed|, |query_ifType|, |hostname|, |host_id|, |snmp_community|, |snmp_username|, |snmp_password|, |snmp_auth_protocol|, |snmp_priv_passphrase|, |snmp_priv_protocol|, |snmp_context|, |snmp_version|, |snmp_port|, |snmp_timeout|
Data Sources: |ds:traffic_in|, |ds:traffic_out|


Top
 Profile  
 
 Post subject: Re: Traffic - using baseline deviation + high/low value?
PostPosted: Fri Sep 14, 2018 6:44 am 
Offline
Cacti Guru User

Joined: Sun Aug 27, 2017 12:05 am
Posts: 1435
Shame you can't try out the newer version of Cacti for your monitoring, in fact our latest development version even has the ability to scan a network range to add devices automatically upon install.

For the purpose of your problem, having thought about this further, I don't think you can get what you are after.

  • THold works off the data source value, not the Graph'd value (which is usually converted using a CDEF).
  • There are two types of breach value (bv)
    • Min/Lower - value falls equal to or below
    • Max/Upper - value falls equal to or above
  • There are two types of breach type (bt)
    • warning
    • error
  • There are three types of trigger detection
    • High / Low - Computed value (cv) is the data source value (dsv), not the displayed graph value (which may have been CDEF'd)
    • Deviation - Computed value (cv) is a percentage of change in the data source value (dsv) from over the given time range (tr) of 15m, 1hr, or 4hr. The same deviation is applied to both breach types (bt).
    • Time-based - Computed value (cv) is the data source value (dsv)
  • The breach window (bw) may be Never (current event only) or between 1 minute and 1 month.
  • The computed value can be manipulated using Data manipulation
  • For each breach type (bt), if the breach value (bv) is set and it is found that the computed value (cv) is beyond the breach value (bv) for the breach count (bc) or more over the breach window (bw), the threshold is considered to be triggered
    eg.
    Code:
    foreach (bt) if (bv != null) {
       if (bv is min/lower) && (cv <= bv over bw) threshold triggered
       if (bv is max/upper) && (cv => bv over bw) threshold triggered
    }

_________________
Cacti Resources:
Cacti Website
Cacti Issues
Cacti Releases

My resources:
How to submit Pull Requests
Development Wiki and How To's
Updated NetSNMP Memory template for Cacti 1.x
Cisco SFP template for Cacti 0.8.8


Top
 Profile  
 
 Post subject: Re: Traffic - using baseline deviation + high/low value?
PostPosted: Sun Sep 16, 2018 2:03 pm 
Offline

Joined: Thu Sep 13, 2018 2:48 pm
Posts: 4
netniV wrote:
Shame you can't try out the newer version of Cacti for your monitoring, in fact our latest development version even has the ability to scan a network range to add devices automatically upon install.

For the purpose of your problem, having thought about this further, I don't think you can get what you are after.


Fair enough, thanks for the input! Unfortunately the decision on what we use has already been made by the powers that be :\


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 6 posts ] 

All times are UTC - 5 hours


Who is online

Users browsing this forum: No registered users and 2 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  

Protected by Anti-Spam ACP Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group