For all graphs, values are recorded at five different time intervals. The first is the 'Active Refresh Rate'. The second is every 5 minutes, the third is every 30 minutes, the forth every 3 hours, and the fifth every 18 hours. The Mode the Workspace is currently in determines whether all, only the 5min, 30 min, 3 hour and 18 hour, or none (off) of the recordings are taking place. If a Workspace is 'Off', none of the measurements are taken. If in 'Fully Active' then all records are taken and stored. If the mode is '5 Min Refresh' then all records, except the Active, are taken and stored.
The 'History Size' of the recording is the number of measurements that will be taken before older values are discarded. If this discard did not take place then the amount of data would escalate and eventually present a problem. The 'History Size' for 'Active Refresh Rate' can be specified for each target. The '5 Minute' and '30 Minute' history sizes are limited to 360 recordings. This means:
This offers five different time scales.
The 'Active Refresh Rate' can be set to any value greater then 100ms (except in the case of the Remote-Script Aquirer which is limited to one second lower range). The reason for the 100ms bottom limit is to help protect the monitoring computer from being overloaded. The 'Active Refresh Rate' data, unlike the other recordings, is kept in the monitoring computers memory and never stored on disk. If an Aquirer has a new target added or an existing target removed then the Aquirer is said to restart. The restart will need to re-create the storage area for the targets and existing 'Active' records are lost. All other recordings are stored on disc and are not affected. Changing the 'History Size' of a target in an Aquirer will also require the restart of the Aquirer and therefore the loss of active recording data. All other modifications to Targets would at most require what is referred to as an Aquirer reload, which maintains all records.
Graphs on a Workspace usually show the 'Active Refresh Rate' recordings. You can, however, select on a per graph basis which of the five different recordings to normally show. This is referred to as the 'Display Recording' and is one of the Graph properties.
It may be useful to set all graphs on a Workspace to show the same recording temporarily. This can easily be done with the 'Overrider Default Recording' option available on the toolbar and menubar (under 'Workspace'). All graphs, regardless of the 'Display Recording' setting, will be changed to the selected recording. You will note that the recording selected becomes highlighted. Click the override again it will be de-activated, restoring all graphs to their individual 'Display Recording' property.
Each Target can be drawn in its own color. The option to draw the Target in either a line or bar is offered. Bars are similar to line graphs, except that the area below the measured value is filled in. Take care when setting more than two targets on the same graph to Bars, one may hide the other. This is not a problem with line targets. Line Targets are drawn over Bar Targets. This ensures the Line Targets are not obscured by Bar Targets.
Two types of Graphs are available, Counter and Gauge. Understanding the difference between them is essential to get the information you require. If you wanted to graph the speed of a car, but you only have the distance reading on the speedometer, then you would use counter. Counters measure the change over time. If the car is stationary the distance reading would not change regardless of how long you waited. If it was moving quickly, the value would change quickly. If you were not measuring the change from the distance of the speedometer, you would not get the speed, but the distance, which if graphed would be an ever rising graph (assuming movement). So, in short, if a value is for ever increasing and you want to know how fast it is increasing you need to plot a counter, the rate of change. This is usually the type required when measuring the amount of data passed through an interface per second, especially with SNMP.
If, on the other hand you want to measure how fast a car was going when given the speed on the speedometer the situation is much simpler, simply read the value. This a Gauge measurement. The value you want is given, and is not for-ever increasing.
The Value Type dictates in what form the data is stored. There are two options, Unsigned Integer and Floating Point. Both use 64 bits of data per value. If you are storing a value that could have a decimal point in it then select Floating, if there is no chance of a decimal point and the value is always positive, then use Integer. Counters should usually use Integer. This is because a counter is stored as the value obtained (there are exceptions to this rule), and not the rate. This is worked out when required. Thus to get the most resolution out of the counter recordings, set as an Integer.
Dictates what data is taken to make the various recordings. There are three options to choose from:
As already stated each graph has up to 5 different recordings. Each records a value after a period of time. The first is at the user definable Active Rate, then 5 minutes, 30 minutes, 3 hours and finally 18 hours. With the Active Refresh Rate recording a measurement is made and recorded. With each successive recording the number of sample measurements increases. The value that is required to be stored needs to be obtained from these samples. The Consolidation Method defines how these samples are combined in order to get the value for the various recordings. In the case of average, the Average of all samples is taken. In the case of Maximum then the maximum value found during the period is used. The Minimum, likewise, will take the minimum value found in the period.
Lets take an example. Let say that the Active Refresh Rate is set to take a measurement every 30 seconds. So by the time a value for the 5 minute recording is required, 10 measurements have been taken. If the Consolidation Method was set to average then the average of all 10 values is taken to get the value for the 5 minute recording. If the maximum option was chosen then the highest of the 10 values is used for the 5 minute recording.
In the event the graphs are running in the 5 minute Mode, then the values taken from the 5 minutes recordings go to make up the other recordings.
How the Consolidation is done, depends on the Graph Type. Changing either the Consolidation Method or the Graph type will result in a question asking if all recordings for the target should be cleared. If you have a time period of a recordings using a Consolidation Method of average, then there is no way of converting this to Maximum. Because how the consolidation is actually done also depends on the Graph Type (i.e. Gauge and Counter), changing this will also result in being asked if recordings should be deleted.
The first is the simplest, being no scales at all. With this no indication of the X or Y values on the graph are offered. The second type uses the 'Graph Indicator'. It can be a very useful option when the size of the graph needs to be kept as small as possible. It is only really useful for graphs which are scaled to the max value shown automatically. A bar is offered on the right hand side of the graph which indicates how the current maximum value on the y scale of the graph compares to the 'Max Value'. For now lets assume only one target is displayed on the graph. The idea is if you know the maximum value of the Target, the bar indicates how close the current maximum value displayed is to the 'Max Value'. If, for example the highest value on the graph is 10, and the targets 'Max Value' is set to 20, the bar will show 50%, (the bottom half of the bar is green, the top half is white). If the maximum value shown in the graph exceeds the 'Max Value' then the bar will show a green bottom and a red top. The change-over will be the proportion the current maximum graph value displayed if exceeding the 'Max Value'. This may sound a little complicated but once used a few times it's advantages should be clear. If a graph contains more than one Target, the indicator will use the Target with the greatest 'Max Value'.
An example of where the Indicator Scale may be of value may help to clarify. Lets say you are measuring the amount of bandwidth passing through an interface. You know the interface can only have a max value of say 256 bytes per second. If measurements are made in bytes per second, then set the 'Max Value' property to 256. The bar will then represent what proportion of the bandwidth the interface is currently carrying with respect to its 'Max Value', which is often all you really need. This is only of real value if the YMax is at <auto> and YMin is set to 0 (See below).
Things in the real world are, however, a little more complicated than shown above. If you have 512kbps WAN link and you want to measure it using SNMP, your intuition may want you to enter a value of 512000 for 'Max Value'. This is not correct, as usually bytes rather than bits are measured (SNMP usually refers to them as octets, eights). So, if you are making measurements in bytes per second you will have to convert your 512000 bits to bytes, which means divide by 8, giving 64000.
'Full Scales' set the graph to show X and Y Axis with labeled values. The scales can take up a lot of space so graphs need to be relatively large to be useful. Gridlines will be added with the option 'Full Scales with Gridlines'.
Also See: the section called “YMax / YMin”
The Y scale of the graph can be restricted to bounds set by the 'YMin' and 'YMax' values. If the 'YMin' or 'YMax' value is deleted altogether then the system will set the values to <Auto>. <Auto> means that the minimum value, in the case of 'YMin', will be set to the minimum value found for the data in the time span shown by the graph. The same applies for YMax, except the maximum value located is used. <Auto>'s will allow for all data to be fitted into the graph. The graphs will always show the zero point of the y axis. So if a minimum value of 5 and a maximum value of 15 are found on the graph, the minimum y value drawn will be zero and the maximum will be 15, but if your minimum were -5 then the graph will show -5 to 15 on the y scale.
So why would setting a value for 'YMin' or 'YMax' be useful. Here's one example. Well lets say you were measuring a counter of the distance reading on your cars speedometer. Since the distance value always increases the change over time will always be positive. But there is an exception. If your distance counter has a limited number of digits, as all do, there will come a time when the counter turns over to zero. This will then produce a negative value for that period of time, and the negative value will be very large. If you were graphing this value then at the point the values turn over, say from 999999 to 000000 the graph will show a massive negative spike. This will be so large that the speed values you are actually interested in will be drawn out if YMin where set to <auto>. But if YMin where set to zero the graph would not show this negative spike at the turn-over. Now for most cars the distance on the speedometer may never turnover during the life of the car, but when measuring bandwidth usage on interfaces, this turn over can occur frequently, depending on the amount of data the interface carries, and the number of digits used to measure the interface.
Another example of when using this could be useful would be if you where trying to locate which workstation is saturating a WAN link. Lets say this network has a WAN link of 512bps and a LAN of 100000bps. All workstations are backed up over the LAN at full speed during the evening. Allowing YMax to be run as <auto> would mean that over a time period that includes the backup, the YMax would show a max of 1000000bps. Data at the lower values would be drawn out, hiding useful information about which workstation is saturating the WAN link. Setting a 'YMax' would allow for better resolution on the graph for the lower values, and therefore give you the information required.
The color of the graph background and the area around the graph can be selected. 'The Graph Font Color' is a setting of the Workspace. This color defines what color will be used to draw the scales and, if required, the color used in the Graph Title. When selecting the 'Graph Win Color' and 'Graph Back Color', consider what color the graph font is and what color the graph marks are. If your 'Graph Font Color' is white and your 'Graph Back Color' is white you will not be able to see the scales. The graph header is optional and can be toggled from a right click on the graph or from the properties window 'Graph Has Title'. The title of the graph can be edited from the 'Title' properties option.
The actual graphed value is calculated as follows:
GraphValue=(RecordedValue + OffSet) * Multiplier
This allows for the shifting and expanding of the graph. Useful if your values recorded need to modified. Default values are 0 for the Offset and 1 for the Multipler which means the graph values are not altered in any way from the recorded values.
|Copyright (c) Warren Flemmer 2006||www.net-probe.com|