On 17 February 2014 18:48, Jeremy Laidman <user-71895fb2e44c@xymon.invalid> wrote:
For this reason, it seems to make sense that the "link" lines are probably
the best for this, as I would think that they would show packets contained
only in physical frames (ethernet or some other medium).
On thinking about this, I think the correct way to handle this is to
exclude all but the "link" interfaces, because we're looking at interface
bytes, not IP bytes, UDP bytes ICMP bytes, etc, but all interface bytes.
Another way of thinking about this is that I would expect the switch port
bps numbers to be the same as my server's bps numbers.
So I'm proposing that the FreeBSD client be adjusted from this:
echo "[ifstat]"
netstat -i -b -n | egrep -v "^lo|<Link"
To this:
echo "[ifstat]"
netstat -i -b -n | egrep "<Link"
And that the Xymon server parsing code PCRE string be adjusted to match
that format, which has MAC addresses in place of IPv4/IPv6 host addresses
(but sometimes empty) and "<Link#n>" in place of network addresses.
This might not be a good idea if people are already relying on the current
way of handling FreeBSD data. If so, you'll get almost the same numbers
(slightly more with ARP and other layer-2 stuff), and you'll also get
loopback addresses added to your interface graphs. Personally I have no
problem showing loopback addresses, they can often show insights into local
processes that communicate amongst themselves.
Seem reasonable? Would anyone be adversely impacted by this suggested
change?
Cheers
Jeremy