|
|
To better understand network trends and trend reporting, it helps to have a clear picture of where the information that Trend Reporter uses comes from and how it differs from the real-time data monitored by other TrafficDirector applications. For example, in TrafficDirector, there are two specific kinds of tables in the SQL database server from which you can generate reports. Depending on which database you choose, you will see very different results. This chapter describes the database tables in TrafficDirector to help you understand the report differences and make the correct choice for the report results you want.
When you generate a report, TrafficDirector retrieves the information you request from one or more SQL database servers. Within the report database, information is stored in three kinds of topology-specific tables.
| Snapshot tables | Where raw statistical data collected by your probes is stored. The TrafficDirector "dbextrad" daemon converts snapshot data into "detail" data that is usable for reporting. |
| Detail tables | Contain delta values that represent network activity over intervals of time, or "detail" data, useful for showing an accurate picture of short term patterns in network activity. |
| Daily tables (or Summary table) | Contain data for a 24-hour period, as logged by the TrafficDirector dbrolld daemon. Reports based on daily information are useful in determining long term trends and patterns of network activity. Use daily tables to generate history reports that show statistics over a period of weeks or months. |
When you use Trend Reporter to generate reports, information is read from the database tables and formatted according to the configuration parameters in the report template. Several predefined templates are available that you can use to generate reports (Table 44-1).
For example, when you select a Segment History template and generate a report for an Ethernet segment from the daily database tables, Trend Reporter retrieves information about the utilization percentage, packets, and errors from the Ethernet daily table and uses it to create a report that displays these statistics over time in 24-hour samples.
The report data logging intervals you define for an agent, together with the amount of time you continue to log data determines the amount of data samples that are available for reporting. A smaller the logging interval creates more data samples, while a larger logging interval creates fewer data samples.
Table 44-1 shows how quickly the number of samples increases when you log at smaller intervals.
| Logging Interval | Number of Samples in 1 Day | Number of Samples in 7 Days |
|---|---|---|
| 1440 minutes (24 hours) | 1 | 7 |
| 480 minutes (8 hours) | 3 | 21 |
| 240 minutes (4 hours) | 6 | 42 |
| 120 minutes (2 hours) | 12 | 84 |
| 60 minutes (1 hour) | 24 | 168 |
| 30 minutes | 48 | 336 |
| 15 minutes | 96 | 483 |
| 5 minutes | 288 | 2016 |
| 1 minute | 1440 | 100800 |
You can easily calculate the number of samples generated for a specific logging interval over time by using the following equation:
If you specify a logging interval of 5 minutes, and log data for 24 hours, your equation looks like this:
If 288 samples are generated in one 24-hour period, you can figure the number of samples generated in a week by multiplying by 7 days:
The number of samples generated is significant because it can greatly affect the display results when you generate history reports.
You can control the number of data samples displayed between a history report start and end time by specifying the Display Resolution (or interval) when you run the report. The Display Resolution value defaults to 1 minute. If you do not change this setting, the Display Resolution automatically adjusts upward to display the Minimum Logging Frequency (MLF), or the smallest interval at which report data is logged during the report start and end time.
You can select Display Resolutions from 1 minute up to 24 hours, keeping in mind that Trend Reporter will only display data at resolutions that are equal to or greater than the MLF for the agent you select. Also, keep in mind that any given report graph can display up to 500 data samples. This means that if you generate a report that returns more than 500 data samples, only the first 500 are actually displayed. To see the remaining samples, select a higher display resolution and then run the report again. You can then zoom in on a portion of the history graph to take a closer look a particular group of samples. See "Zooming In on History Reports" in Chapter 43, "Displaying Reports."
Breaks in data occur when there is no data logged in the database for the given samples. Breaks in plot graphs indicate that no data was logged to the database for the given samples. In bar graphs, either no data is displayed for an interval (leaving a blank space on the graph), or the data is displayed as having a "zero" value (a flat-shaded area on the x axis). Zero value data samples (a value on the graph is plotted as zero) indicate that data is available, but that its value is zero.
Asterisk symbols (*) indicate when a domain has been reinstalled during an interval. The data displayed for the interval reflects the activity logged from the point that the domain was reinstalled, until the end of the interval. It is an inaccurate representation because it does not represent data logged for the entire interval.
By determining at what point, and for how long, a domain was deinstalled, you can judge the accuracy of the information. Do this by generating the report again at lower display resolutions until you can pinpoint when the domain was deinstalled, and when it was reinstalled.
You may have utilization for a single eight-hour period displayed as five percent, when it really only represents one hour of time--the one hour that the domain was present in the agent so utilization statistics could be logged against it.
If the report display resolution is high, generate the same report at the lowest display resolution to find out how long the domain was deinstalled, and data was not logged against it. For example, if a report with an 8-hour resolution shows that a domain was reinstalled sometime between 10 a.m. and 6 p.m., you may want to generate the report again with a start time of 10 a.m., and an end time of 6 p.m., with a display resolution of 1 hour or less. Depending on the amount of time that the domain was deinstalled, the data displayed may or may not be close to the actual network traffic for that 8-hour period.
|
|