Nagios XI - How To Delete A Data Source From An RRD File

Overview

This KB article explains how to remove a data source from an RRD file.

This article applies if you are seeing similar entries in the log file /usr/local/nagios/var/perfdata.log after enabling debug logging in /usr/local/nagios/etc/pnp/process_perfdata.cfg

2016-04-28 09:55:04 [25200] [1] RRDs::update ERROR /usr/local/nagios/share/perfdata/10.25.6.51/CPU_Usage_for_VMHost.rrd: 
expected 2 data source readings (got 2) from 1461801279

You'll also observe that your performance graphs are no longer showing any data.

Explanation

When a plugin returns performance data to Nagios, it can include more than one data source. A data source is a measurement unit that is used to generate graphs.

A plugin might return two data sources, like the following example:

ESX3 OK - cpu usage=1160.00 MHz (3.62%) | cpu_usagemhz=1160.00Mhz;; cpu_usage=3.62%;;

The first time that this data is received an RRD (round robin database) file is created to store the data for this service. When the RRD file is created, it is created based on the number of data sources that was received for this service.

If you decide later that you want to remove a data source because you don't need that data collected, for example:

cpu_usagemhz=1160.00Mhz;;

The next time the background process runs, when it attempts to insert the data into the RRD file, it fails and is discarded because the RRD file expects that two data sources are received.

There are two possible solutions to fix this problem:

• Delete the RRD file and let it generate a new one

  • You lose all historical performance data

• Delete the data source from the RRD file

  • You retain the historical performance data

In the example below, we'll be deleting the data source cpu_usagemhz from the RRD file.

Compile Modify Script

You need to download and compile a script to be able to delete a data source from the RRD file.

Establish an SSH session to your Nagios XI server and type the following commands:

cd /tmp
wget "http://downloads.sourceforge.net/project/pnp4nagios/PNP-0.6/pnp4nagios-0.6.26.tar.gz?r=&ts=1452788875&use_mirror=iweb" -O /tmp/pnp4nagios-0.6.25.tar.gz
tar zxf /tmp/pnp4nagios-0.6.26.tar.gz
cd /tmp/pnp4nagios-0.6.26
./configure
make all
cp /tmp/pnp4nagios-0.6.26/scripts/rrd_modify.pl /tmp/
chmod +x /tmp/rrd_modify.pl

The next steps will continue in this SSH session.

Delete Data Source

Now it's time to delete the data source.

Before doing that, the following needs to be explained.

• Performance Data files are stored in the location /usr/local/nagios/share/perfdata/HOSTNAME/

  • HOSTNAME refers to the name of the host object in Nagios (cAse SenSITIve)

    • If the HOSTNAME contains spaces, the spaces are replaced with and _ underscore

    • This example uses the hostname 10.25.6.51

  • Every SERVICE in this directory has an .rrd and .xml file named after the service object in Nagios (cAse SenSITIve)

    • If the SERVICE contains spaces, the spaces are replaced with and _ underscore

    • This example uses the service CPU_Usage_for_VMHost

• The data source name we are removing is cpu_usagemhz

The first step is to identify the data source number that we want to delete. Type the following command:

grep -B 1 '<NAME>cpu_usagemhz' /usr/local/nagios/share/perfdata/10.25.6.51/CPU_Usage_for_VMHost.xml

This will output something like:

<DS>1</DS>
<NAME>cpu_usagemhz</NAME>

The number between the <DS></DS> tags is what we are after, in this example it is 1

IF that command returned NO output, you'll need to run this command:

rrdtool info /usr/local/nagios/share/perfdata/10.25.6.51/CPU_Usage_for_VMHost.rrd | grep 'last_ds'

This will output something like:

ds[1].last_ds = "1657.00"
ds[2].last_ds = "7.91"

You need to look at the values displayed and determine which is the one you want removed. Because in this example I am wanting to delete cpu_usagemhz it is clear that ds[1].last_ds = "1657.00" is the one that needs to be removed.

The number inside the ds[] square brackets is what we are after, in this example it is 1

These commands will run the modify script to create an updated file with the data source removed, then rename the old file and then implement the new file.

cd /usr/local/nagios/share/perfdata/10.25.6.51/
/tmp/rrd_modify.pl /usr/local/nagios/share/perfdata/10.25.6.51/CPU_Usage_for_VMHost.rrd delete 1
mv CPU_Usage_for_VMHost.rrd CPU_Usage_for_VMHost.rrd.bak
mv CPU_Usage_for_VMHost.rrd.chg CPU_Usage_for_VMHost.rrd
chown nagios.nagios CPU_Usage_for_VMHost.rrd
chmod 775 CPU_Usage_for_VMHost.rrd

Once you have executed all of these commands, after about 15 minutes you will see the graphs in Nagios working correctly again.

For clarity, this command:

/tmp/rrd_modify.pl /usr/local/nagios/share/perfdata/10.25.6.51/CPU_Usage_for_VMHost.rrd delete 1

Equates to:

/tmp/rrd_modify.pl /usr/local/nagios/share/perfdata/HOSTNAME/SERVICENAME.rrd delete DATASOURCENUMBER

Additional Information

If you need to ADD a data source to an RRD file, please follow this KB article:

Documentation - ICMP and Ping Checks Stopped Graphing

Final Thoughts

For any support related questions please visit the Nagios Support Forums at:

http://support.nagios.com/forum/