[Xymon] Gaps in graphs

[Carl Melgaard]

On Thu, 4 Mar 2021 at 21:44, Carl Melgaard <Carl.Melgaard at stab.rm.dk<mailto:Carl.Melgaard at stab.rm.dk>> wrote:
Hi,
How serious is gaps in graphs – for instance disk-graphs etc. Is a gap the same as potential missing alerting on events?
Regards,
Carl Melgaard

>Yes, usually gaps in graphs are caused by missing data points. In the case of the disk graph, this is usually caused by missing client data messages that are not being sent from host to Xymon server, for some reason - such as stopping the Xymon client at just the wrong time. It's also >possible that client data messages are not being sent in a timely manner - if two data points are fed into RRD within the same 5-minute interval, the second one is ignored, and then the next 5-minute interval with have no data point.
>One unlikely cause of missing graphs is that the client data message is being truncated. If the disk stats are after the point of truncation, then there are no data points to add to the RRD file, so you'll see a gap. I would check your xymond.log file for messages like "Oversize data/client msg >from 10.1.1.1 truncated n=<msgsize>, limit <msglimit>). If disk graphs are affected by a section earlier in the message, it's likely that other graphs are also affected by this - the [df] section is followed by [free] (memor), then [ifconfig] and all the other sections used for network stats. >Perhaps scan down the graphs on the trends page looking for similar gaps.
>I've seen client data message truncation cause missing data points, but, it's actually unlikely this is the cause of your problem. All of the client data sections that are likely to cause truncation are after the sections that are used for the standard graphs (including disk). But it couldn't hurt to >check. Message limit defaults can be changed in the xymonserver.cfg file - search the man page for MAXMSG_CLIENT for more details.
>If the cause is something else, I suspect you'll still find clues in your xymond.log file. But also check rrd-data.log and rrd-status.log.

So, I looked through the logs. Xymond.log doesn’t point to anything besides the normal spam in there, except this one: Sending dropstate (from xymond) with xxx

But in the rrd-data.log and rrd-status.log I have this occurring (more than once):

rrd-data.log
2021-03-03 01:24:19.002264 xxx/netstat.rrd: Bug - duplicate RRD data with same timestamp 1614731059, different data

rrd-status.log
2021-03-03 02:55:15.003177 xxx/disk,tmpfs.rrd: Bug - duplicate RRD data with same timestamp 1614736515, different data

I recently updated to newest version of Xymon (from a very old version), and it seems I carried over some MAXMSG-settings:

MAXMSG_STATUS="5180590"
MAXMSG_CLIENT="5180590"
MAXMSG_DATA="5180590"
#MAXMSG_CLIENT=512              # clientdata messages (default=512k)
#MAXMSG_STATUS=256              # general "status" messages (default=256k)
#MAXMSG_DATA=256                # "data" messages, if enabled (default=256k)

And if Xymon now thinks numbers are in kilobyte instead of bytes, I seem to have allocated A LOT more memory perhaps?

Regards,

Carl Melgaard
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.xymon.com/pipermail/xymon/attachments/20210305/e9997178/attachment.htm>