Metric values for sflow-RT

[Fahri]

Hey everyone,
thank you for supporting sflow-rt and keep developing apps.

Im using sflow-rt for openvSwitch and gathering metrics. Thanks the Peter for awesome blog posts i can managed to create my own metric gathering script and send them to influx/grafana.

But currently i dont know what are these values for.

For example
im getting "2.1000.ovs_dp_flows" metric. im knowing this value for ovs-dpctl reference txt.

but i dont know these metric values;
"ifinpkts" 
"ifoutpkts"

first of all i thought these are packet counts but im confused because its shows 0.4 , 100.20 kind of values.

and am i doing right with these values ? i want to look interface status by looking these metrics is thats the right way ?  should i look for flows for "bytes" ?




Thanks
Best Regards
-Fahri

[Peter Phaal]

ovs_dp_flows is a gauge (the number of flow entries in the OVS kernel datapath). 

http://blog.sflow.com/2015/01/open-vswitch-performance-monitoring.html

sFlow-RT reports the latest value of the gauge in queries.

ifinpkts, ifoutpkts are counters. sFlow-RT calculates counter deltas over time and reports packets/second as the metric value. Generally the raw counters are not of particular interest, packet rates, byte rates, utilizations are more interesting metrics. 

If you were sending the raw counters to InfluxDB/Grafana then you would typically apply a DERIVATIVE() function to the counter. sFlow-RT is performing the derivative function automatically when it receives counters.

It's often useful to do additional metric rollups before sending them to InfluxDB:

http://blog.sflow.com/2014/12/influxdb-and-grafana.html

http://blog.sflow.com/2016/10/collecting-docker-swarm-service-metrics.html

[Fahri]

Yes i am trying to get network status , packet number(total number of packets) like ofnet/mininet trafficgenerator.
I can look how many flows is written by ovs , how many hits , misses etc... But now i need to look interface status how many packets in how many packets out ? byte size kind of stuff...(im using metrics not flows for this)
And i was trying to do this actually - http://blog.sflow.com/2015/01/open-vswitch-performance-monitoring.html
These metrics  im looking for ovs.
flows , hits , lost and misses are normal decimal numbers ? Like flows is ovs-dptcl dump flows count and hits so on.
Basically ovs part is ok. I have documentation on openvswitch.org site for what is what.

2.1000.ovs_dp_flows	18
2.1000.ovs_dp_hitrate	99.998
2.1000.ovs_dp_hits	13,814.3
2.1000.ovs_dp_lost	0
2.1000.ovs_dp_maskhitsperpacket	14.533
2.1000.ovs_dp_masks	18
2.1000.ovs_dp_misses	0.3
2.1000.ovs_dp_missrate	0.002
2.1000.ovs_mask_hits	200,763.8

ifinpkts, ifoutpkts are counters. sFlow-RT calculates counter deltas over time and reports packets/second as the metric value.

So if i want to look last 5min packet count in grafana i should do cumulative_sum() kind of func i guess.

After your answer currently im sending these metrics
4.ifinutilization    0.637
but still i dont know what this value for ?
I want to look total packets sending by interface , total packets incoming interface. Ex. network status is on attack or load? Am i looking right metrics?
Thank you for answer Peter

-Fahri




28 Ocak 2018 Pazar 20:03:14 UTC+3 tarihinde Peter Phaal yazdı:

[Peter Phaal]

It looks like you would need to use the InfluxDB INTEGRAL() function to convert the rates into a sum of total packets over 5 minute intervals:

https://docs.influxdata.com/influxdb/v1.4/query_language/functions/#integral

[Fahri]

Hello again,
This is my current view on "ifinpkts" metric.
I want to look number of packets arrived on interface last 5 minutes. And also im needing what unit i select for value on left-x axes.

After using integral function(i hope im using right way) its looks like this:

So which one should i use for displaying total packets in from interface title and which unit i use for this?
*im not using any math operation to send this metrics to influxdb just taking from sflow and sending to influxdb

Thanks
-Fahri

[Fahri]

i placed pictures wrong sorry below is mean() , top is with intgeral func()

31 Ocak 2018 Çarşamba 14:24:50 UTC+3 tarihinde Fahri yazdı:

[Peter Phaal]

The units for the sFlow-RT ifinpkts metrics are packets/second. 

Using the mean() function to calculate a moving average still results in packets/second units.

I don't have any experience of using the integral() function, but if you integrate over a period of a minute then the units should be packets/minute.

Looking at your charts, you are still reporting that data at 5 second intervals, you need to roll up the data to 5 minute intervals if you want five minute totals.

--
You received this message because you are subscribed to the Google Groups "sFlow-RT" group.
To unsubscribe from this group and stop receiving emails from it, send an email to sflow-rt+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Fahri]

Thanks for your help.
My dashboard looks much more correct and stable thanks to you.
So basically if i want to look anything total in x minutes i should use integral in grafana is that applies for ovs_flows and if_octets ?

according to this (http://openvswitch.org/support/dist-docs/ovs-vswitchd.conf.db.5.html)

 ifindex: optional integer, in range 0 to 4,294,967,295
              A positive interface index as defined for SNMP  MIB-II  in  RFCs
              1213  and  2863,  if  the  interface  has  one, otherwise 0. The
              ifindex is useful for seamless integration with  protocols  such
              as SNMP and sFlow.

In RFC-1213
it says ifinOctets
"

"The total number of octets received on the interface, including framing characters."
"
(also are these same as ifinpkts , ..)
when i created js for sflow and set interval for 5sec. the metric im getting is octets/5sec ? Is that true or sflow sending me total octets in 5sec ?

*sorry for asking so much questions 
Thanks
-Fahri

[Peter Phaal]

The sFlow datagrams sent by the switch reports the ifInOctets counter. sFlow-RT computes the ifinoctets metric as the difference between successive counter values divided by the time interval between the two values, i.e. the octets / second.

ovs_flows is a gauge, not a counter. The sFlow agent reports the number of flows in the OVS flow table and sFlow-RT latches the most recent value as the metric.

[Fahri]

I have last question.

i have 2 network ethA for controller - switch . ethB for users
In my configuration sflow inside ethB network.
Adding port to switch like this i can see metrics on sflow-rt.
ovs-vsctl add-port br0 ethB

But i cant see any metrics from ethA interface. After adding by add-port br0 ethB. I can see metrics on sflow-rt.
But is this the right way to do this?
Should i connect my controller to switch by add-port or is there a sflow configuration i should change?
(http://docs.openvswitch.org/en/latest/howto/sflow/) this is the conf im using for adding sflow to br0

Thanks
-Fahri

[Neil McKee]

Hi Fahri,

I don't think it makes sense to tie your "control" network into your "users" network just for visibility.

One way to address this is to run hsflowd (http://sflow.net) and configure it something like this in /etc/hsflowd.conf:

sflow {

  sampling = 400

  sampling.1G = 400

  pcap { dev = ethA }

  ovs { } 

  collector { ip=10.1.2.3 }

}

Now hsflowd will:

(1) apply packet-sampling and counter-polling to the ethA NIC

(2) automatically configure OVS to send sFlow to 10.1.2.3:6343

(3) report standard CPU/mem/IO stats for the server too (which sFlow-RT will see as a bunch of new metrics)

If your Linux kernel is 3.19 or newer the "pcap { dev = ethA }" entry will run sampling in the kernel (via BPF),  so it will be just as efficient as the OVS packet-sampling and the CPU consumed by hsflowd should be << 1%.

The sampling N given to OVS will be the default rate (sampling=400 here) while the rate used for the NIC will be determined by the ifSpeed,  hence the inclusion of the sampling.1G setting.

Hope this helps.

Neil

------
Neil McKee
InMon Corp.
http://www.inmon.com

[Fahri]

Hey Neil,
Thank you for the pointing me to the right direction. Its just like what i want. Also github repo is amazing. It has dockerfile even for different distros.
I think i will using hsflowd for my docker env too.

But i have two questions;
If i set my sflow polling like 1 is that eats too much bandwith for my network? is it overkill to making 1sec?

I was checking hsflowd status in services
every minute or so its like setting up a new sflow is this normal ?
"[Time] /usr/bin/ovs-vsctl setting sflow commands..."

((2) automatically configure OVS to send sFlow to 10.1.2.3:6343)

Thanks
-Fahri

[Neil McKee]

You could set the polling to 1 second.  It might result in an uneven graph however,  because of the way that the kernel updates the counters under /proc with one periodicity and hsflowd reads them on another.   This approach can also end up generating significant quiescent load on the collector when the system is large because every datasource will report every second even when nothing much is happening.  If you care about detecting changes quickly then try to use the packet-samples (i.e. define flows in sFlow-RT and set thresholds on them).  The packet-samples have the very desirable property of providing near-instant information about hotspots,  and not burdening the collector with unchanging details from everywhere else:

http://blog.sflow.com/2013/02/measurement-delay-counters-vs-packet.html

Thanks for pointing out that hsflowd's mod_ovs is issuing a "set" every minute.  It looks like there was a small change to the ovs-vsctl output that made hsflowd think the config was not quite in sync.  I don't think ovs-vswitchd will be doing any work because we are just repeating an existing setting, but the latest hsflowd "master" branch now has a patch.   So if you are building from sources then please "git pull" and "./docker_build_on <platform>" again.  Then confirm that the warnings have stopped.

https://github.com/sflow/host-sflow/commit/79ac5155506025b8351af47be03afacc474b4e89

Neil

------
Neil McKee
InMon Corp.
http://www.inmon.com