New URL's and rrd's

[Carter Bullard]

Gentle people,
With the new URL/URI output strategies, its now time to talk about  
additional
output methods in argus and the ra* programs.

In particular, writing out argus metrics to rrd's seems like a natural  
thing
to do, as many systems like Ganglia (just as an example) poke some of
their data into rrd's and use tobias's graphing to generate strip  
charts.
We do the same thing with ragraph(), but delete the rrds when we're  
done.

I'm thinking that this maybe the way to integrate argus data with  
systems
like MRTG, Zenoss, etc... as we can populate rrd's and have the other
system do the drawing etc....

I'm thinking that this scenario may be useful as a place to start the
discussion.

Writing to rrd;s could be as simple as:

    rabins -S radium -B 5s -M rmon hard time 60s -m srcid saddr  \
       -s spkts dpkts sbytes dbytes sloss dloss \
       -w rrd-file:://path/to/rrds/\$srcid_\$addr_data

This example sez, write the 60s source and destination packet totals,  
byte
totals, and loss metrics for specific IP addresses, to an rrd titled  
with the
probe id and IP address.

If you were to replace the "rrd-file" with "mysql" all would work the  
same,
just the data would go into a mysql table, rather than an rrd file  
(RRA).

Rabins() is the program or choice. It generates 'bin' metrics, that are
"hard" aligned to a 60 second boundary (rrdtool really needs data
to conform to its concepts of time). The -B option causes rabins() to
hold data for 5 seconds before 'outputing' so that you get all the data
in from your remote argi/radii, and the "-m srcid saddr" with the
"-M rmon" option makes it so that the data is rmon style data for
the IP addresses seen in the stream.

just a few thoughts, ...., so what do you think?  Would direct rrd
support be of interest?


Carter

Carter Bullard
CEO/President
QoSient, LLC
150 E 57th Street Suite 12D
New York, New York  10022

+1 212 588-9133 Phone
+1 212 588-9134 Fax