<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Jeremy –<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Thx! You are a life saver! Commenting out the “HWPREDICT” line in /etc/xymon/rrddefinitions.cfg made the insane RRD file sizes go down!<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> # 8064 datapoints w/ 5 minute interval = 28 days @ 5 min avg.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> #RRA:HWPREDICT:8064:0.1:0.0035:2016 // <-- This was the bad boy!<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:#1F497D">~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D">David Mills<br>
Systems Administrator</span><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><br>
</span><b><i><span style="font-size:11.0pt;color:#1F33ED">Northrop Grumman</span></i></b><span style="font-size:11.0pt;color:#1F497D"><br>
(512) 595-1238 (mobile)</span><span style="font-size:11.0pt;color:#1F497D"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Jeremy Laidman [mailto:jeremy@laidman.org]
<br>
<b>Sent:</b> Wednesday, March 28, 2018 11:11 PM<br>
<b>To:</b> Galen Johnson <Galen.Johnson@sas.com><br>
<b>Cc:</b> Mills,David (HHSC Contractor) <David.Mills@hhsc.state.tx.us>; Shawn Heisey <hobbit@elyograg.org>; xymon@xymon.com<br>
<b>Subject:</b> Re: [Xymon] RRD files are too big<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">The code that creates the RRD files is:<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"> setupfn2("%s.%s.rrd", "ifstat", ifname);<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">So the format is "ifstat.<ifname>.rrd".<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">The weird numbers and names are what Xymon thinks are interface names (ifname). Xymon gets the interface names from the [ifstat] section of the client message. I suspect the parsing code for the OS you are using is not compatible with the
format that is in the [ifstat] section. If you can provide the [ifstat] section of client message, and the OS or class specification (typically found at the top of the client message), I might be able to be more specific.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">If you've changed a host from Solaris to Linux, but still have the OS defined as Solaris (or CLASS set in hosts.cfg), the wrong match expression will be applied (for a different OS), and you may get this effect.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Until you find a fix, a work-around might be to specify INTERFACES:eth\d+ (or whatever regular expression matches your interface names) in hosts.cfg.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On 29 March 2018 at 05:54, Galen Johnson <<a href="mailto:Galen.Johnson@sas.com" target="_blank">Galen.Johnson@sas.com</a>> wrote:<o:p></o:p></p>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt">
<p class="MsoNormal">I'm betting that you are correct that these are your interface names on that server. Running 'ifconfig -a' might help better identify what you're seeing, If they are virtual devices, they may be coming and going in such a way that Xymon
sees them, and adds them but they are named something else the next run since I would expect the timestamps to be the same if they were all active.<br>
<br>
=G=<br>
<br>
________________________________________<br>
From: Xymon <<a href="mailto:xymon-bounces@xymon.com">xymon-bounces@xymon.com</a>> on behalf of Mills,David (HHSC Contractor) <<a href="mailto:David.Mills@hhsc.state.tx.us">David.Mills@hhsc.state.tx.us</a>><br>
Sent: Wednesday, March 28, 2018 1:28 PM<br>
To: Shawn Heisey; <a href="mailto:xymon@xymon.com">xymon@xymon.com</a><br>
Subject: Re: [Xymon] RRD files are too big<br>
<br>
EXTERNAL<o:p></o:p></p>
<div>
<div>
<p class="MsoNormal"><br>
Thx, Shawn...<br>
<br>
I agree that the naming suggests some unique connection info like an IP, but I don’t see any of our IPs embedded into those names. The snippet I offered earlier was from a Windows box. The following is an example from one of our Solaris 11 hosts. Note that
the RRD files with "net<digit>" correspond to iface names net0, ... In the example that follows, the "vnetldc" probably refers to a virtual network interface tag since this host is part of a Solaris LDOM. The trailing hex digits probably have the same identifying
function as the four dotted numbers in my original example, though I still don't know what they mean:<br>
<br>
-rw-r--r-- 1 xymon xymon 423K Mar 28 11:12 ifstat.net0.rrd<br>
-rw-r--r-- 1 xymon xymon 423K Mar 28 10:12 ifstat.net1.rrd<br>
-rw-r--r-- 1 xymon xymon 423K Mar 28 10:12 ifstat.net2.rrd<br>
-rw-r--r-- 1 xymon xymon 423K Mar 28 10:12 ifstat.net3.rrd<br>
-rw-r--r-- 1 xymon xymon 423K Mar 28 10:16 ifstat.net4.rrd<br>
-rw-r--r-- 1 xymon xymon 423K Mar 28 11:47 ifstat.phys.rrd<br>
-rw-r--r-- 1 xymon xymon 423K Mar 28 11:02 ifstat.vnetldc0x10.rrd<br>
-rw-r--r-- 1 xymon xymon 423K Mar 28 11:52 ifstat.vnetldc0x11.rrd<br>
-rw-r--r-- 1 xymon xymon 423K Mar 28 12:02 ifstat.vnetldc0x12.rrd<br>
-rw-r--r-- 1 xymon xymon 423K Mar 28 11:42 ifstat.vnetldc0x13.rrd<br>
-rw-r--r-- 1 xymon xymon 423K Mar 28 10:12 ifstat.vnetldc0x14.rrd<br>
-rw-r--r-- 1 xymon xymon 423K Mar 28 10:12 ifstat.vnetldc0x15.rrd<br>
-rw-r--r-- 1 xymon xymon 423K Mar 28 11:02 ifstat.vnetldc0x2.rrd<br>
-rw-r--r-- 1 xymon xymon 423K Mar 28 12:02 ifstat.vnetldc0x39.rrd<br>
-rw-r--r-- 1 xymon xymon 423K Mar 28 12:17 ifstat.vnetldc0x3a.rrd<br>
-rw-r--r-- 1 xymon xymon 423K Mar 28 12:07 ifstat.vnetldc0x3b.rrd<br>
-rw-r--r-- 1 xymon xymon 423K Mar 28 11:32 ifstat.vnetldc0x3c.rrd<br>
-rw-r--r-- 1 xymon xymon 423K Mar 28 11:32 ifstat.vnetldc0x3d.rrd<br>
-rw-r--r-- 1 xymon xymon 423K Mar 28 10:12 ifstat.vnetldc0x3e.rrd<br>
-rw-r--r-- 1 xymon xymon 423K Mar 28 11:52 ifstat.vnetldc0x3f.rrd<br>
<br>
<br>
~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~<br>
David Mills<br>
Systems Administrator<br>
Northrop Grumman<br>
(512) 595-1238 (mobile)<br>
<br>
-----Original Message-----<br>
From: Xymon [mailto:<a href="mailto:xymon-bounces@xymon.com">xymon-bounces@xymon.com</a>] On Behalf Of Shawn Heisey<br>
Sent: Wednesday, March 28, 2018 11:03 AM<br>
To: <a href="mailto:xymon@xymon.com">xymon@xymon.com</a><br>
Subject: Re: [Xymon] RRD files are too big<br>
<br>
On 3/28/2018 9:12 AM, Mills,David (HHSC Contractor) wrote:<br>
><br>
> On a related note, I see lots (sometimes dozens, depending on the<br>
> client) of RRD files with names “ifstat.#.#.#.#.rrd”, where the ‘#’<br>
> are numbers, like this sampling:<br>
><br>
> -rw-r----- 1 xymon xymon 423K Mar 6 20:07 ifstat.47.147.0.12.rrd<br>
><br>
> -rw-r----- 1 xymon xymon 423K Mar 6 20:12 ifstat.108.0.121.0.rrd<br>
><br>
> -rw-r----- 1 xymon xymon 423K Mar 7 02:53 ifstat.73.68.58.9.rrd<br>
><br>
> -rw-r----- 1 xymon xymon 423K Mar 7 09:23 ifstat.0.1.0.128.rrd<br>
><br>
> -rw-r----- 1 xymon xymon 423K Mar 7 09:23 ifstat.0.116.111.32.rrd<br>
><br>
> -rw-r----- 1 xymon xymon 423K Mar 7 09:23<br>
> ifstat.101.115.115.32.rrd<br>
><br>
<br>
Looks like the filenames are generated from information sent by the xymon client running on the host. I see files with interface names on my Xymon server. These are from a client running on a SPARC Solaris system:<br>
<br>
rrd/sahara/ifstat.bge1.rrd<br>
rrd/sahara/ifstat.bge3.rrd<br>
rrd/sahara/ifstat.bge2.rrd<br>
rrd/sahara/ifstat.bge0.rrd<br>
<br>
I'm running 4.3.23, RPM package built from source. These ifstat files are 38K in size.<br>
<br>
I would have guessed that the numbers were IP addresses, but you've got two of them in that list starting with zero, and one ending with zero, so if those are IP addresses, there may be an invalid address configured somewhere. And if they're not IP addresses,
then I have no idea what they are, and you may need to look into the client running on the host.<br>
<br>
Thanks,<br>
Shawn<br>
<br>
_______________________________________________<br>
Xymon mailing list<br>
<a href="mailto:Xymon@xymon.com">Xymon@xymon.com</a><br>
<a href="http://lists.xymon.com/mailman/listinfo/xymon" target="_blank">http://lists.xymon.com/mailman/listinfo/xymon</a><br>
_______________________________________________<br>
Xymon mailing list<br>
<a href="mailto:Xymon@xymon.com">Xymon@xymon.com</a><br>
<a href="http://lists.xymon.com/mailman/listinfo/xymon" target="_blank">http://lists.xymon.com/mailman/listinfo/xymon</a><br>
_______________________________________________<br>
Xymon mailing list<br>
<a href="mailto:Xymon@xymon.com">Xymon@xymon.com</a><br>
<a href="http://lists.xymon.com/mailman/listinfo/xymon" target="_blank">http://lists.xymon.com/mailman/listinfo/xymon</a><o:p></o:p></p>
</div>
</div>
</blockquote>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</body>
</html>