question with monitoring Statistics

[badguy]

Any one have a logical reason why the packets going out are negative?

ps: the graph is generated by symon and i am trying to reflect positive as the inbound packets

[jggimi]

You don't mention what you're running, but based on your previous posts, I will assume 4.5, and not -current.

Since 4.5, there have been mbuf problems resolved, as well as a migration to a newer version of symon (2.79) You can either try -current, or wait two weeks and upgrade to 4.6.

If neither of those options are of interest, take a look through the symon source code, see what data it is collecting, how it collects it, and then collect it yourself and manually review it. You're not going to get problem source identification through looking at a graphical abstraction of unknown data.

[badguy]

ok so my assumption is that syweb is responsible for how collection of data. I have taken a look at it and symon documentation says the setup.inc file is responsible for the graph outputs

i induced a setup.inc file which i guess syweb uses to generate the graphs. Just in case some one can mk sense out of the code. All that seems that can be done is change the graph size layout and not its output

Also the PF statistics does not graph out negative output. Why is this different from the regular interface? (see attached stat.jpg)

Im just curious

[jggimi]

1. Install the applicable ports tree for your release/flavor of the OS in /usr/ports.
2. Change to the /usr/ports/sysutils/symon directory, and use "make patch" to download and patch the symon software. The patch to mbuf, as I mentioned above, will apply if you are running a modern enough system.
3. Look at the working directory. Depending on your OS currency and any local customized environment variables, this might be /usr/ports/obj/symon-<version>/symon-<version>/
4. Examine the ../platform/OpenBSD/sm_if.c module. This is the module that collects NIC data.
5. Note that it collects data with ioctl(3).
6. If you have the skill, you can write your own ioctl(3) program, and collect the data yourself, looking for negative values. You can then prove to yourself whether the values returned are being reflected in charting correctly or not.
7. If the values are negative, you could post to misc@ and ask for advice from kernel developers regarding how to interpret them.
8. If the values are never negative, but are reflected as such by symon, you will need to determine the root cause within symon. You can, as I recommended, engage the maintainer to assist you with this step.
9. If you do not have the skills for steps 6-8, yourself, you could use OpenBSD's built in netstat(1) utilility while also using symon, looking for discrepancies.
10. You could also just report your problems with symon to the ports@ mailing list, if nothing else.

I will repeat, posting graphs is not helpful. Nor is the unreadable configuration file you attached.

[badguy]

Thanks I guess i misunderstood where u were driving at in ur previous post. I will try out the upgrade and play around with it.