I want to alert on a value going into an RRD file as a GAUGE type. This is standard stuff for things like tcp.conn.rrd:sec as per the man page for analysis.cfg. I can setup a rule in analysis.cfg such as:

DS dns tcp.dns.rrd:sec >=0.2 COLOR=red "TEXT=DNS TCP response time &V exceeded threshold &U seconds"

This alerts when the connection time exceeds 200ms. But this technique doesn't seem to work for all data sources, and I'm not sure why.

My understanding is that analysis.cfg is processed by xymond_client, which runs as a worker module for "xymond_channel --channel=client". This means that the threshold test would only be performed from numbers within the client message, because that's the only data source that xymond_client has.

Yet the tcp.dns.rrd file is populated from data coming out of xymonnet, which I believe sends to xymond as a status message, rather than as a client message. So I can't understand how xymond_client gets the numbers for tcp.dns.rrd, or anything else from xymonnet.

Can anyone explain the process by which xymond_client gets the tcp.conn.rrd or tcp.dns.rrd file's data for it to do the thresholding and modify the conn/dns message? And perhaps why only some data can be used in DS entries in analysis.cfg?

Cheers Jeremy