Re: [rrd-users] Handling frequent counter-wraps

On Wed, Mar 07, 2007 at 06:24:43PM +0100, Rickard Dahlstrand wrote:
> Hi,
>
> I'm trying to log load from a NSD DNS-server and it wraps the counter
> every time we update the zone (every 2 hours). This introduces
> unknown-values in the rrd-file. I would like rrdtool to figure out that
> a wrap has occured and calculate a correct value.
>
> Is it me asking to much from rrdtool or have do I need to change the
> configuration?

This has been asked and answered a couple of times, even recently (last
week or so?) See the mail archive for details, sorry no pointer as I am
too lazy right now to search them myself.

> Time UnixTime Zone UnixZone Counter Diff
> 11:05 1173265500 09:56 1173261360 1527837
> 11:10 1173265800 09:56 1173261360 1580265 52428
> 11:15 1173266100 09:56 1173261360 1634669 54404

Somewhere between 11:15 and 11:20 you update your zone. This happens
at time "T". A counter is set to zero. You lost two important rates:
between 11:15 and T, (say values 1634669 to 1683500) and between
T and 11:20 (values 0 to 971).

> 11:20 1173266400 11:19 1173266394 971 -1633698
> 11:25 1173266700 11:19 1173266394 52998 52027
> 11:30 1173267000 11:19 1173266394 104549 51551
> 11:35 1173267300 11:19 1173266394 154445 49896


At timestamp T-2 sec., update using the last known value just before this
zone update. The closer the better.
At timestamp T-1 sec., update using "U" for unknown
At timestamp T, update using zero

When using COUNTER, that 971 at 11:20 will be computed against the zero
at time "T", which is correct.

You will have two seconds (T-2 .. T) per two hours unknown. Unless you
have a very rigid xff setting, you won't see those unknowns. The rate
during the other 298 seconds of this interval will be your final rate.

In addition, you loose any counter increase between your last update (T-2)
and updating your zone (T).

Alternatives:
#1 try using microsecond precision, reducing the unknown time to much less
#2 compute the differences yourself and use another type of counter,
for instance ABSOLUTE. You can completely eliminate unknowns occuring
due to this counter wrap.

You won't be able to remove all uncertainty, unless you know how to combine
getting the statistics which are valid at the precise moment of updating the
DNS zone.

HTH
--
Alex van den Bogaerdt
http://www.vandenbogaerdt.nl/rrdtool/

_______________________________________________
rrd-users mailing list
rrd-users@lists.oetiker.ch
https://lists.oetiker.ch/cgi-bin/listinfo/rrd-users