I want to alert on a value going into an RRD file as a GAUGE type. This is
standard stuff for things like tcp.conn.rrd:sec as per the man page for
analysis.cfg. I can setup a rule in analysis.cfg such as:
DS dns tcp.dns.rrd:sec >=0.2 COLOR=red "TEXT=DNS TCP response time &V
exceeded threshold &U seconds"
This alerts when the connection time exceeds 200ms. But this technique
doesn't seem to work for all data sources, and I'm not sure why.
My understanding is that analysis.cfg is processed by xymond_client, which
runs as a worker module for "xymond_channel --channel=client". This means
that the threshold test would only be performed from numbers within the
client message, because that's the only data source that xymond_client has.
Yet the tcp.dns.rrd file is populated from data coming out of xymonnet,
which I believe sends to xymond as a status message, rather than as a
client message. So I can't understand how xymond_client gets the numbers
for tcp.dns.rrd, or anything else from xymonnet.
Can anyone explain the process by which xymond_client gets the tcp.conn.rrd
or tcp.dns.rrd file's data for it to do the thresholding and modify the
conn/dns message? And perhaps why only some data can be used in DS entries
in analysis.cfg?
Cheers
Jeremy