On 17 February 2014 18:48, Jeremy Laidman <jlaidman at rebel-it.com.au> wrote:
For this reason, it seems to make sense that the "link" lines are probably the best for this, as I would think that they would show packets contained only in physical frames (ethernet or some other medium).
On thinking about this, I think the correct way to handle this is to exclude all but the "link" interfaces, because we're looking at interface bytes, not IP bytes, UDP bytes ICMP bytes, etc, but all interface bytes. Another way of thinking about this is that I would expect the switch port bps numbers to be the same as my server's bps numbers.
So I'm proposing that the FreeBSD client be adjusted from this:
echo "[ifstat]" netstat -i -b -n | egrep -v "^lo|<Link"
To this:
echo "[ifstat]" netstat -i -b -n | egrep "<Link"
And that the Xymon server parsing code PCRE string be adjusted to match that format, which has MAC addresses in place of IPv4/IPv6 host addresses (but sometimes empty) and "<Link#n>" in place of network addresses.
This might not be a good idea if people are already relying on the current way of handling FreeBSD data. If so, you'll get almost the same numbers (slightly more with ARP and other layer-2 stuff), and you'll also get loopback addresses added to your interface graphs. Personally I have no problem showing loopback addresses, they can often show insights into local processes that communicate amongst themselves.
Seem reasonable? Would anyone be adversely impacted by this suggested change?
Cheers Jeremy