Short description of how PerfParse summarizes raw data


IMPORTANT NOTE: The features described below are available as of version 0.104.9!

Raw Summary Data

Besides the performance data provided by the nagios plugins, there is another set of data that might be of interest: the raw plugin data. This data is stored by perfparse in the perfdata_service_raw table. This data is especially usefull if you don't need data on the performance of a certain service, but rather on its availability. For example, the performance figures of an SMTP service will tell you how fast your SMTP is responding. The raw data will tell you how long the service was available.
In most cases, the amount of raw data is enormous, since you typically get an entry every 5 minutes (this depends on your nagios setup, of course). In an effort to limit the amount of data (and processing) needed to get availability figures, PP also stores a summary of the raw data.

Note: Currently PP only stores the summary data in the mySQL database, providing of course that you enabled the mySQL storage module. Reports that use this summary data are not available yet.

How does PP summarize the raw data?

  • Besides the textual output, a raw data record contains a timestamp, the host and service name it's related to, and the plugin result (aka nagios_status), which can be 0 (OK), 1 (WARNING), 2 (CRITICAL) or 3 (UNDEFINED).
  • A summary record keeps track of the total time a service was in one of these four states. This total time can be found in the sum_uptime, sum_warntime, sum_criticaltime and sum_undeftime columns of the perfdata_raw_summary_data table. A new summary record is created every day.
  • When PP receives a raw data record, it calculates the difference between the current timestamp and that of the previous record. The result is then added to the column related to the previous state in the summary record. In other words, PP assumes that a service is in the previous state until the time it receives a new record.

For example, suppose the following records are received:
00:00:00 - OK
00:05:00 - OK
00:10:00 - CRITICAL
00:12:00 - WARNING
00:16:00 - OK
The resulting summary record will show:
sum_uptime: 10 min, sum_warntime: 4 min, sum_criticaltime: 2 min, sum_undeftime: 0 min

Example of a monthly report

PP does not have a report (yet) that uses the summary table. Below is an example of an SQL query that retrieves the data for the month of december. This could be used for importing your data into e.g. Excel or any other DB report generator tool.
SELECT S.host_name, S.service_description, D.epoch, Sum(D.sum_criticaltime) AS 'TotalCriticaltime', Sum(D.sum_undeftime) AS 'TotalUndeftime', Sum (D.sum_uptime) AS 'TotalUptime', Sum(D.sum_warntime) AS 'TotalWarntime', Sum(D.count) AS 'TotalCount' FROM perfdata_raw_summary_data D INNER JOIN perfdata_service S ON S.service_id = D.service_id WHERE D.epoch_start>=unix_timestamp('2004-12-01') AND D.epoch_start<=unix_timestamp('2004-12-31') AND (D.epoch=86400) GROUP BY S.host_name, S.service_description, D.epoch

Advanced issues


The PP default 'epoch' (or timespan) used for the raw summary records is 86400 seconds, or 1 day. Currently, there is no option to change this default to something else (although I'd like to add it one of these days), but you can change or even add other timespans. To change the timespan of a certain service, you need to do two things:
  1. look up the service_id in the perfdata_service table
  2. using the service_id, update the 'epoch' field of the related perfdata_raw_summary record.

Of course you can also simply add a new record in the perfdata_raw_summary table for the service, as long as it's a different epoch value (e.g. 3600 for one hour summaries)

Contributors to this page: TimW .
Page last modified on Tuesday 18 of January, 2005 06:02:37 UTC by TimW.


redflo, 14:25 UTC, Sun 10 of Apr, 2005: No, lneuxyuhje, this shall write to a pipe not to a file and so ">" is o.k.
lneuxyuhje, 15:14 UTC, Thu 07 of Apr, 2005: is ">" meant to be ">>" in /usr/local/perfparse/bin/perfparse_nagios_pipe_command.pl ?
redflo, 08:35 UTC, Tue 05 of Apr, 2005: fhdplbvjipsld, it works now. Permissions were wrong.
fhdplbvjipsld, 14:42 UTC, Wed 30 of Mar, 2005: How to post to Forums->Help?
benclewett, 09:27 UTC, Thu 03 of Feb, 2005: Hi Jon! I hope you like our wiki site.