Xymon Mailing List Archive search

RRD Files Growing Large

4 messages in this thread

list Eliza Danyi · Tue, 29 Jan 2019 15:47:51 -0500 ·
Hi all,

We are running Xymon 4.3.28-1.el7.terabithia on CentOS 7.6 and I've noticed
that the .rrd files in /var/lib/xymon/rrd/servername/ are getting quite
large, some up to 30MB per host. I was wondering if this is normal
behavior? I've read several
<https://lists.xymon.com/archive/2018-July/045645.html>; threads
<https://lists.xymon.com/archive/2017-November/045052.html>; indicating that
these files are not really supposed to grow and should be quite small. Any
thoughts about why this might be happening?

The rrddefinitions.cfg is still the default if that matters.

Thanks,
*Eliza Danyi*
E-mail: user-d7b2efa5cd13@xymon.invalid

*Don't be a phishing victim -- VCU and other reputable organizations will
never use email to request that you reply with your password, social
security number or confidential personal information.  For more details,
visit **https://ts.vcu.edu/about-us/information-security/common-questions/what-is-phishing/
<https://ts.vcu.edu/about-us/information-security/common-questions/what-is-phishing/>;
*
list Dave "doughnut" Fogarty · Tue, 29 Jan 2019 14:53:19 -0800 (PST) ·
That seems pretty bug to me.  Mine are all under a meg.

When you run 'rrdtool info somebigfile.rrd' does it have a lot of different
data-sources ("ds")?  Mine tend to directly correlate.

Here's some output from looking at a couple average rrd files for me.

$ ls -l la.rrd vmstat.rrd
-rw-r--r-- 1 xymon xymon  19640 Jan 29 14:09 la.rrd
-rw-r--r-- 1 xymon xymon 323384 Jan 29 14:24 vmstat.rrd
$ rrdtool info vmstat.rrd | less
$ rrdtool info la.rrd | less
$ rrdtool info la.rrd | fgrep 'index = '
ds[la].index = 0
$ rrdtool info vmstat.rrd | fgrep 'index = '
ds[cpu_r].index = 0
ds[cpu_b].index = 1
ds[cpu_w].index = 2
ds[mem_swpd].index = 3
ds[mem_free].index = 4
ds[mem_buff].index = 5
ds[mem_cach].index = 6
ds[mem_si].index = 7
ds[mem_so].index = 8
ds[dsk_bi].index = 9
ds[dsk_bo].index = 10
ds[cpu_int].index = 11
ds[cpu_csw].index = 12
ds[cpu_usr].index = 13
ds[cpu_sys].index = 14
ds[cpu_idl].index = 15
ds[cpu_wait].index = 16
$ rrdtool dump la.rrd | wc
    2399   18567  195686
$ rrdtool dump vmstat.rrd | wc
    2991   19271 1030655
list Eliza Danyi · Wed, 30 Jan 2019 16:04:31 -0500 ·
Thanks, Dave - Other than the wc for the rrdtool dump and the actual size
of the files mine looks similar to yours. Here are the outputs for those
commands on my box:

$ ls -lh la.rrd vmstat.rrd
-rw-r--r--. 1 xymon xymon 213K Jan 30 14:53 la.rrd
-rw-r--r--. 1 xymon xymon 3.5M Jan 30 15:16 vmstat.rrd
quoted from Dave "doughnut" Fogarty
$ rrdtool info la.rrd | fgrep 'index = '
ds[la].index = 0
rrdtool info vmstat.rrd | fgrep 'index = '
ds[cpu_r].index = 0
ds[cpu_b].index = 1
ds[cpu_w].index = 2
ds[mem_swpd].index = 3
ds[mem_free].index = 4
ds[mem_buff].index = 5
ds[mem_cach].index = 6
ds[mem_si].index = 7
ds[mem_so].index = 8
ds[dsk_bi].index = 9
ds[dsk_bo].index = 10
ds[cpu_int].index = 11
ds[cpu_csw].index = 12
ds[cpu_usr].index = 13
ds[cpu_sys].index = 14
ds[cpu_idl].index = 15
ds[cpu_wait].index = 16
$ rrdtool dump la.rrd | wc

  27054  214609 2251244
$ rrdtool dump vmstat.rrd | wc
  28558  216225 11768579

The rrddefinitions.cfg file looks like this:

# Xymon RRD parameters
#
# This defines the number of datapoints stored for each RRD, and the
# RRD "consolidation functions" applied. See the rrdtool documentation
# for details.
#
# NB: Changes here only apply to newly created RRD files. To change
# your existing RRD databases, use the rrdtool utilities to modify
# your existing files.

# include additional sections
directory /etc/xymon/rrddefinitions.d

# Each section key is the column- or data-name reported from your
# client test. Typically this is "cpu", "memory", "tcp", or some
# custom test you have created.

# Definition for frequent ifmib polling (once per 60 seconds)
# The setup for this is identical in granularity to the default
# setup, but since data is fed into the RRD once every 60 seconds,
# we use 5 times as many Primary data points for each of the
# Consolidated data points actually stored in the RRD file.
[ifmib/60]
        RRA:AVERAGE:0.5:5:576
        RRA:AVERAGE:0.5:30:576
        RRA:AVERAGE:0.5:120:576
        RRA:AVERAGE:0.5:1440:576


# This one is the default setup. You can change it, if you like.
[]
        # 576 datapoints w/ 5 minute interval = 48 hours @ 5 min avg.
        RRA:AVERAGE:0.5:1:576
        # 576 datapoints w/ 6*5 minute averaged = 12 days @ 30 min avg.
        RRA:AVERAGE:0.5:6:576
        RRA:MIN:0.5:6:576
        RRA:MAX:0.5:6:576
        # 576 datapoints w/ 24*5 minute averaged = 48 days @ 2 hour avg.
        RRA:AVERAGE:0.5:24:576
        RRA:MIN:0.5:24:576
        RRA:MAX:0.5:24:576
        # 576 datapoints w/ 288*5 minute averaged = 576 days @ 1 day avg.
        RRA:AVERAGE:0.5:288:576
        # 8064 datapoints w/ 5 minute interval = 28 days @ 5 min avg.
        RRA:HWPREDICT:8064:0.1:0.0035:2016

Does anyone know when the line 'RRA:HWPREDICT:8064:0.1:0.0035:2016' was
added to this configuration by default?

Thanks,
*Eliza Danyi*
Operating Systems Analyst
Virginia Commonwealth University
quoted from Eliza Danyi
E-mail: user-d7b2efa5cd13@xymon.invalid

*Don't be a phishing victim -- VCU and other reputable organizations will
never use email to request that you reply with your password, social
security number or confidential personal information.  For more details,
visit **https://ts.vcu.edu/about-us/information-security/common-questions/what-is-phishing/
<https://ts.vcu.edu/about-us/information-security/common-questions/what-is-phishing/>;

• On Tue, Jan 29, 2019 at 6:02 PM Dave "doughnut" Fogarty <
quoted from Dave "doughnut" Fogarty
user-138a88324cb7@xymon.invalid> wrote:
That seems pretty bug to me.  Mine are all under a meg.

When you run 'rrdtool info somebigfile.rrd' does it have a lot of different
data-sources ("ds")?  Mine tend to directly correlate.

Here's some output from looking at a couple average rrd files for me.

$ ls -l la.rrd vmstat.rrd
-rw-r--r-- 1 xymon xymon  19640 Jan 29 14:09 la.rrd
-rw-r--r-- 1 xymon xymon 323384 Jan 29 14:24 vmstat.rrd
$ rrdtool info vmstat.rrd | less
$ rrdtool info la.rrd | less
$ rrdtool info la.rrd | fgrep 'index = '
ds[la].index = 0
$ rrdtool info vmstat.rrd | fgrep 'index = '
ds[cpu_r].index = 0
ds[cpu_b].index = 1
ds[cpu_w].index = 2
ds[mem_swpd].index = 3
ds[mem_free].index = 4
ds[mem_buff].index = 5
ds[mem_cach].index = 6
ds[mem_si].index = 7
ds[mem_so].index = 8
ds[dsk_bi].index = 9
ds[dsk_bo].index = 10
ds[cpu_int].index = 11
ds[cpu_csw].index = 12
ds[cpu_usr].index = 13
ds[cpu_sys].index = 14
ds[cpu_idl].index = 15
ds[cpu_wait].index = 16
$ rrdtool dump la.rrd | wc
    2399   18567  195686
$ rrdtool dump vmstat.rrd | wc
    2991   19271 1030655

list Dave "doughnut" Fogarty · Wed, 30 Jan 2019 13:51:39 -0800 (PST) ·
Yep.  That looks like it.  This is my config from Debian (both xymon 
versions: 4.3.17-6+deb8u1 and 4.3.28-2).
quoted from Eliza Danyi

[]
         # 576 datapoints w/ 5 minute interval = 48 hours @ 5 min avg.
         RRA:AVERAGE:0.5:1:576
         # 576 datapoints w/ 6*5 minute averaged = 12 days @ 30 min avg.
         RRA:AVERAGE:0.5:6:576
         # 576 datapoints w/ 24*5 minute averaged = 48 days @ 2 hour avg.
         RRA:AVERAGE:0.5:24:576
         # 576 datapoints w/ 288*5 minute averaged = 576 days @ 1 day avg.
         RRA:AVERAGE:0.5:288:576


I think it's worth leaving as is, but if you're running low on space, you 
can use rrdtune to clear out some of the predictive data and even remove 
the RRA if you really want. YMMV
quoted from Eliza Danyi


On Wed, 30 Jan 2019, Eliza Danyi wrote:
...
# This one is the default setup. You can change it, if you like.
[]
        # 576 datapoints w/ 5 minute interval = 48 hours @ 5 min avg.
        RRA:AVERAGE:0.5:1:576
        # 576 datapoints w/ 6*5 minute averaged = 12 days @ 30 min avg.
        RRA:AVERAGE:0.5:6:576
        RRA:MIN:0.5:6:576
        RRA:MAX:0.5:6:576
        # 576 datapoints w/ 24*5 minute averaged = 48 days @ 2 hour avg.
        RRA:AVERAGE:0.5:24:576
        RRA:MIN:0.5:24:576
        RRA:MAX:0.5:24:576
        # 576 datapoints w/ 288*5 minute averaged = 576 days @ 1 day avg.
        RRA:AVERAGE:0.5:288:576
        # 8064 datapoints w/ 5 minute interval = 28 days @ 5 min avg.
        RRA:HWPREDICT:8064:0.1:0.0035:2016

Does anyone know when the line 'RRA:HWPREDICT:8064:0.1:0.0035:2016' was added to this configuration by default?