Events Per Minute

[smillin]

Sorry if this has been covered before -- I did a search but didn't find what I am looking for.

I'm looking for a way to find out how many events per minute a particular server is getting. My goal is to get a baseline of events per minute, then make some changes to parent/child relationships, and then find out how many events per minute. That will tell the story on how effective the child/parent things are.

Thanks in advance!

-Shane

[mcapra]

nagiostats can tell you how many active checks were executed in a 1/5/15 minute interval (among many other metrics). I'm assuming that is what you're looking for? "events" is a bit ambiguous in this case:

Code: Select all

[root@capra_nag ~]# nagiostats

# bunch of preceding stat info

Active Host Checks Last 1/5/15 min:     1 / 1 / 1
   Scheduled:                           1 / 1 / 1
   On-demand:                           0 / 0 / 0
   Parallel:                            1 / 1 / 1
   Serial:                              0 / 0 / 0
   Cached:                              0 / 0 / 0

Active Service Checks Last 1/5/15 min:  3 / 3 / 3
   Scheduled:                           3 / 3 / 3
   On-demand:                           0 / 0 / 0
   Cached:                              0 / 0 / 0

The binary is found in /usr/local/nagios/bin/nagiostats if your system can't find the command.

[lmiltchev]

@smillin, did mcapra answer your question? Is it ok if you close this topic?

[smillin]

That might do what I need, but I'm not sure if it's exactly what I need. Here is the order of operations I'd like to accomplish.

1. Unplug a NIC, switch or server.
2. Make a note of how many alerts are generated.
3. Plug everything back in.
4. Create/modify parent/child relationships.
5. Unplug the same NIC, switch or server.
6. Make a note of how many alerts are generated.
7. Analyze the difference between steps 2 and 6.

Does that make sense? It's kind of a goofy thing to try to put down into text, haha.

Thanks for your help!!

-Shane

[dwhitfield]

1. Unplug a NIC, switch or server.

So, you're trying to determine how many alerts are generated in XI if something is down, not how many things are actually down...correct?

[smillin]

That is correct. Trying to avoid the "one switch went down, so let's throw out 48 alerts" situation. And then I'm trying to document how the parent/child config fixed that issue.

[dwhitfield]

I don't know how many network devices you have, but seems like it could be a lot of unplugging, unless you are just doing one proof of concept.

There are other ways to do this, but those would require changes to configs or would only last until the next good check, so might not be ideal.

[smillin]

Yes, this is mainly just a proof of concept item. Once it's proven how drastic the parent/child config helps, we will no longer need to collect this data.

[dwhitfield]

Sounds good. Let us know if you need anything else!