Traffic - using baseline deviation + high/low value?

Support questions about the Threshold plugin

Moderators: Moderators, Developers

Post Reply
Author
Message
tones
Posts: 4
Joined: Thu Sep 13, 2018 2:48 pm

Traffic - using baseline deviation + high/low value?

#1 Post by tones » Thu Sep 13, 2018 3:07 pm

Hi folks,

We've inherited a Cacti build for traffic monitoring across various routers - Version 0.8.8c using Thold 0.5 - something I'd like to do is set up a template that uses baseline deviation as a base, but then alerts on a fixed minimum value (in bits or bytes). Is this possible? Maybe by modifying the data by RPN Expression? Minimal experience with Cacti or RPN Expressions.

Trying to catch issues with very low traffic following transport events. A threshold breach will occur initially, which is fine, but on restoration would also like to know if any interfaces stay below a set value, say 10,000 (as an aside, do not understand how Cacti calculates its traffic values but that's another thing).

Any ideas here?

netniV
Cacti Guru User
Posts: 2689
Joined: Sun Aug 27, 2017 12:05 am

Re: Traffic - using baseline deviation + high/low value?

#2 Post by netniV » Thu Sep 13, 2018 5:36 pm

First problem you will have is that the version of Cacti you are using is quite old. I'm not sure if the version of THold for 0.8.8 had those capabilities and if so, how far they went.

Certainly, the Cacti 1.1.38 with Thold 1.0.5 would handle that as far as I am aware.

tones
Posts: 4
Joined: Thu Sep 13, 2018 2:48 pm

Re: Traffic - using baseline deviation + high/low value?

#3 Post by tones » Thu Sep 13, 2018 9:08 pm

netniV wrote:First problem you will have is that the version of Cacti you are using is quite old. I'm not sure if the version of THold for 0.8.8 had those capabilities and if so, how far they went.

Certainly, the Cacti 1.1.38 with Thold 1.0.5 would handle that as far as I am aware.
Yeah that's part of the problem - because we now don't have anyone that knows how to work Cacti, it's going to be replaced with something else, so upgrading Cacti isn't likely to happen due to both resources and expertise - but it's what I've got to work with right now :(

tones
Posts: 4
Joined: Thu Sep 13, 2018 2:48 pm

Re: Traffic - using baseline deviation + high/low value?

#4 Post by tones » Thu Sep 13, 2018 9:22 pm

The data manipulation options I have are Exact Value, CDEF, Percentage and RPN Expression with:

RPN Expression
An RPN Expression is an RRDtool Compatible RPN Expression. Syntax includes all functions below in addition to both Host and Data Query replacement expressions such as |query_ifSpeed|. To use a Data Source in the RPN Expression, you must use the syntax: |ds:dsname|. For example, |ds:traffic_in| will get the current value of the traffic_in Data Source for the RRDfile(s) associated with the Graph. Any Data Source for a Graph can be included.
Math Operators: +, -, /, *, %, ^
Functions: SIN, COS, TAN, ATAN, SQRT, FLOOR, CEIL, DEG2RAD, RAD2DEG, ABS, EXP, LOG, ATAN, ADNAN
Flow Operators: UN, ISINF, IF, LT, LE, GT, GE, EQ, NE
Comparison Functions: MAX, MIN, INF, NEGINF, NAN, UNKN, COUNT, PREV
Replacement Fields: |query_ifAlias|, |query_ifDescr|, |query_ifHighSpeed|, |query_ifHwAddr|, |query_ifIndex|, |query_ifIP|, |query_ifName|, |query_ifOperStatus|, |query_ifSpeed|, |query_ifType|, |hostname|, |host_id|, |snmp_community|, |snmp_username|, |snmp_password|, |snmp_auth_protocol|, |snmp_priv_passphrase|, |snmp_priv_protocol|, |snmp_context|, |snmp_version|, |snmp_port|, |snmp_timeout|
Data Sources: |ds:traffic_in|, |ds:traffic_out|

netniV
Cacti Guru User
Posts: 2689
Joined: Sun Aug 27, 2017 12:05 am

Re: Traffic - using baseline deviation + high/low value?

#5 Post by netniV » Fri Sep 14, 2018 6:44 am

Shame you can't try out the newer version of Cacti for your monitoring, in fact our latest development version even has the ability to scan a network range to add devices automatically upon install.

For the purpose of your problem, having thought about this further, I don't think you can get what you are after.
  • THold works off the data source value, not the Graph'd value (which is usually converted using a CDEF).
  • There are two types of breach value (bv)
    • Min/Lower - value falls equal to or below
    • Max/Upper - value falls equal to or above
  • There are two types of breach type (bt)
    • warning
    • error
  • There are three types of trigger detection
    • High / Low - Computed value (cv) is the data source value (dsv), not the displayed graph value (which may have been CDEF'd)
    • Deviation - Computed value (cv) is a percentage of change in the data source value (dsv) from over the given time range (tr) of 15m, 1hr, or 4hr. The same deviation is applied to both breach types (bt).
    • Time-based - Computed value (cv) is the data source value (dsv)
  • The breach window (bw) may be Never (current event only) or between 1 minute and 1 month.
  • The computed value can be manipulated using Data manipulation
  • For each breach type (bt), if the breach value (bv) is set and it is found that the computed value (cv) is beyond the breach value (bv) for the breach count (bc) or more over the breach window (bw), the threshold is considered to be triggered
    eg.

    Code: Select all

     foreach (bt) if (bv != null) {
       if (bv is min/lower) && (cv <= bv over bw) threshold triggered
       if (bv is max/upper) && (cv => bv over bw) threshold triggered
    }

tones
Posts: 4
Joined: Thu Sep 13, 2018 2:48 pm

Re: Traffic - using baseline deviation + high/low value?

#6 Post by tones » Sun Sep 16, 2018 2:03 pm

netniV wrote:Shame you can't try out the newer version of Cacti for your monitoring, in fact our latest development version even has the ability to scan a network range to add devices automatically upon install.

For the purpose of your problem, having thought about this further, I don't think you can get what you are after.
Fair enough, thanks for the input! Unfortunately the decision on what we use has already been made by the powers that be :\

Post Reply