<div dir="ltr"><div>I often see those kind of interface RRD files on systems that have Docker containers running on them. Every time a new container is started, a random interface like that is created on the host for the container network (and thus an RRD file is created). Every time a container is restarted, a new random interface is created for it and the old interface isn't used anymore, but the RRD file remains for it. For me at least, these are on systems that we don't admin but still monitor with Xymon, so I never know when the containers will be created/restarted/etc.<br></div><div><br></div><div>Depending on how often the containers are restarted/created/etc., the number of random veth* interface RRD files per host can be A LOT. Normally, they aren't very large by themselves, but I can see how combined it might take up a considerable amount of space.</div><div><br></div><div>I run <a href="https://wiki.xymonton.org/doku.php/addons:finit" target="_blank">https://wiki.xymonton.org/doku.php/addons:finit</a> periodically to find inactive RRD files and remove the ones that I know won't be updated again. The script will output rm commands you can use to remove the inactive RRD files. You just need to change the HomeDir and Threshold (in seconds) variables to what you want to use. This script works really well to find and clean up the inactive random veth* interfaces (and other inactive RRD files). It can also help to find hosts that can just be removed (dropped) completely from Xymon instead ('xymon drop X').<br></div><div><br></div><div>Alternatively, if you don't care about these network interfaces, and know the specific interfaces you do care about, you could use the INTERFACES option on the host entries in hosts.cfg:</div><div><br></div><div style="margin-left:40px"> INTERFACES:REGEXP<br> On systems with multiple network interfaces, the operating system may report a number of net‐<br> work interface where the statistics are of no interest. By default Xymon tracks and graphs<br> the traffic on all network interfaces. This option defines a regular expression, and only<br> those interfaces whose name matches the expression are tracked.</div><div><div><div dir="ltr" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><br></div><div><br></div><div>Hope this helps!</div><div><br></div><div>-- <br></div><div>Matt Vander Werf<br>HPC System Administrator<br>University of Notre Dame<br>Center for Research Computing - Union Station<br>506 W. South Street<br>South Bend, IN 46601<br></div>Phone: (574) 631-0692</div></div></div></div></div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Fri, Sep 20, 2019 at 8:22 PM J.C. Cleaver <<a href="mailto:cleaver@terabithia.org" target="_blank">cleaver@terabithia.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><br>
On Fri, September 20, 2019 5:42 am, Eliza Danyi wrote:<br>
> Morning all,<br>
><br>
> We are currently running Xymon 4.3.28-1.el7.terabithia (on CentOS 7.x) and<br>
> I have been struggling with this since we switched to the RPMs from an<br>
> older version of xymon built from source about a year ago. We've gone from<br>
> a few GB on the old server to now almost 40GB just for this directory.<br>
><br>
> I posed the question a little while back to the group and thought I had<br>
> found the cause in the rrddefinitions.cfg file under the line:<br>
><br>
> RRA:HWPREDICT:8064:0.1:0.0035:2016<br>
><br>
> I tried a few different things but ended up deciding to comment out this<br>
> line to see if it would slow the growth, but it does not appear to be<br>
> working. Is there any reason these files would be increasing in number or<br>
> size? Is there something I can do with rrdtool to clean up data? Is it<br>
> normal that an rrd directory for a single host is upwards of 60M on the<br>
> newer versions of Xymon?<br>
><br>
> Here is an example of the files in a folder for a host:<br>
<br>
Hi,<br>
<br>
RRD files by themselves do not change size (unless intentionally<br>
manipulated), however new RRAs would have been added in I believe when it<br>
was first run.<br>
<br>
The ones you're seeing below, though, are a result of two things; one<br>
easier to fix than the other. Systemd creates "/run/user/xxxx" partitions<br>
on user login, and if the client is running when a new UID is logged in,<br>
you'll get a new RRD file dropped in. This was changed in 4.3.29+ I<br>
believe, but you should be able to exclude them by adding this in to your<br>
analysis.cfg file:<br>
<br>
CLASS=linux<br>
# Ignore some usually uninteresting tmpfs mounts.<br>
DISK /dev IGNORE<br>
DISK /lib/init/rw IGNORE<br>
DISK /sys/fs/cgroup IGNORE<br>
DISK %^/run/user/\d+$ IGNORE<br>
INODE /dev IGNORE<br>
INODE /lib/init/rw IGNORE<br>
INODE /sys/fs/cgroup IGNORE<br>
INODE %^/run/user/\d+$ IGNORE<br>
<br>
After that's in there, you should be able to confirm that the /run/user/*<br>
ones aren't being updated any more and you can purge them.<br>
<br>
The second issue, however, is with your network interfaces:<br>
ifstat.veth08022d9.rrd, etc... It looks like something is giving you<br>
highly variable transient interface names?<br>
<br>
Xymon does not currently have a mechanism to exclude interfaces by name<br>
like this, since they just look like new things to track. Are these<br>
changing during known-events that might be able to trigger a cleanup?<br>
<br>
As a workaround, you should be able to purge ones that have not been<br>
updated after a certain length of time.<br>
<br>
<br>
HTH,<br>
-jc<br>
<br>
<br>
<br>
><br>
> [root@xymon]# du -h --max-depth=1 /var/lib/xymon/rrd/server.example/*<br>
> 216K /var/lib/xymon/rrd/server.example/clock.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/disk,boot.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/disk,dev,shm.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/disk,elasticsearch.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/disk,home.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/disk,root.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/disk,run.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/disk,run,user,0.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/disk,run,user,1000.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/disk,run,user,1001.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/disk,run,user,1002.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/disk,run,user,1003.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/disk,run,user,1004.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/disk,run,user,1014.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/disk,run,user,1016.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/disk,sys,fs,cgroup.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/disk,tmpfs.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/disk,tmp.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/disk,var.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.docker0.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.eno16780032.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.veth0506ddf.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.veth08022d9.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.veth081fb4b.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.veth0828eba.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.veth0ed858f.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.veth164c573.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.veth1740a33.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.veth189a45e.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.veth197189c.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.veth19d7cca.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.veth1dfb69f.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.veth2090f52.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.veth2282b2c.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.veth258f7aa.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.veth273f639.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.veth28aa403.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.veth29630d9.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.veth2c50b73.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.veth2ccd63f.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.veth38ba0c9.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.veth38c413a.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.veth3a47851.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.veth3c5e33e.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.veth3cb1195.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.veth3e20beb.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.veth42dcce0.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.veth4311e0a.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.veth461d830.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.veth4855b73.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.veth5074706.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.veth51e84f6.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.veth525c545.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.veth569cd53.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.veth59a3d88.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.veth5c4439e.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.veth5f09582.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.veth5fa1dd2.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.veth67d3cbf.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.veth67dbb70.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.veth682379a.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.veth684bcf3.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.veth69ab431.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.veth6ad9701.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.veth6c80cac.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.veth6ce4f39.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.veth6e24fbf.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.veth6e59721.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.veth6fb0766.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.veth71f97e2.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.veth741d0d5.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.veth7c752f1.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.veth7f93b1f.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.veth8386dfb.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.veth8e3b4e4.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.veth8f68e08.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.veth9063983.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.veth91bc3c6.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.veth96c1fac.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.veth9a73f58.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.veth9ed52d1.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.vetha09504c.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.vetha184ef3.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.vetha410e0c.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.vetha460481.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.vetha5a56d6.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.vetha6cec13.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.vethad8eda4.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.vethad8faa1.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.vethaffd7df.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.vethb3c04b7.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.vethb426b52.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.vethb52aae4.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.vethb6937d3.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.vethba647c0.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.vethbd846e1.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.vethc01c9dd.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.vethc81bb06.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.vethc8ea13a.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.vethcc1a6d6.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.vethcc51afb.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.vethd01eb33.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.vethd105c62.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.vethd1b1789.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.vethd676e0b.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.vethd947e9e.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.vethdcb0028.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.vethed73659.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.vethf05d463.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.vethf4659bf.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.vethf84f9fc.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.vethf8efbee.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.vethfb569a5.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.vethfb5988e.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.vethfeec0dd.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/ifstat.vethffc6c75.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/inode,boot.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/inode,dev,shm.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/inode,elasticsearch.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/inode,home.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/inode,root.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/inode,run.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/inode,run,user,0.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/inode,run,user,1000.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/inode,run,user,1001.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/inode,run,user,1002.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/inode,run,user,1003.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/inode,run,user,1004.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/inode,run,user,1014.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/inode,run,user,1016.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/inode,sys,fs,cgroup.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/inode,tmpfs.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/inode,tmp.rrd<br>
> 424K /var/lib/xymon/rrd/server.example/inode,var.rrd<br>
> 216K /var/lib/xymon/rrd/server.example/la.rrd<br>
> 216K /var/lib/xymon/rrd/server.example/memory.actual.rrd<br>
> 216K /var/lib/xymon/rrd/server.example/memory.real.rrd<br>
> 216K /var/lib/xymon/rrd/server.example/memory.swap.rrd<br>
> 3.3M /var/lib/xymon/rrd/server.example/netstat.rrd<br>
> 216K /var/lib/xymon/rrd/server.example/procs.rrd<br>
> 216K /var/lib/xymon/rrd/server.example/tcp.conn.rrd<br>
> 216K /var/lib/xymon/rrd/server.example/users.rrd<br>
> 3.5M /var/lib/xymon/rrd/server.example/vmstat.rrd<br>
><br>
><br>
> Do these look like reasonable file sizes/number of files compared to<br>
> everyone else? How much space should we reasonably expect to use for this<br>
> given we have roughly 1k hosts being monitored (mix of Windows and Linux).<br>
><br>
> Thanks,<br>
> *Eliza Danyi*<br>
> Operating Systems Analyst<br>
> VCU Computer Center<br>
> Phone: 804-827-1132<br>
> E-mail: <a href="mailto:danyiem@vcu.edu" target="_blank">danyiem@vcu.edu</a><br>
><br>
> *Don't be a phishing victim -- VCU and other reputable organizations will<br>
> never use email to request that you reply with your password, social<br>
> security number or confidential personal information. For more details,<br>
> visit **<a href="https://phishing.vcu.edu/*" rel="noreferrer" target="_blank">https://phishing.vcu.edu/*</a> <<a href="https://phishing.vcu.edu/" rel="noreferrer" target="_blank">https://phishing.vcu.edu/</a>><br>
> _______________________________________________<br>
> Xymon mailing list<br>
> <a href="mailto:Xymon@xymon.com" target="_blank">Xymon@xymon.com</a><br>
> <a href="http://lists.xymon.com/mailman/listinfo/xymon" rel="noreferrer" target="_blank">http://lists.xymon.com/mailman/listinfo/xymon</a><br>
><br>
<br>
<br>
_______________________________________________<br>
Xymon mailing list<br>
<a href="mailto:Xymon@xymon.com" target="_blank">Xymon@xymon.com</a><br>
<a href="http://lists.xymon.com/mailman/listinfo/xymon" rel="noreferrer" target="_blank">http://lists.xymon.com/mailman/listinfo/xymon</a><br>
</blockquote></div>