[collectd] tail plugin - counter resets

[Vincent McIntyre]

Hi Florian

thanks for your prompt answers.

>> I looked at the other parts of the documentation tree and that seems
>> to suggest the counter is reset if there were no addtitions during an
>> Interval (ie if the rate was zero for the Interval);
> Can you tell me what parts of the documentation you were checking, so I
> can (try to) clarify the behavior there? Thanks :)

It took a while to find but I think I made an incorrect inference from
reading both [1]
and THRESHOLD CONFIGURATION in collectd.conf(5). There's no obvious passage
that maps on to my incorrect statement.

I think it would help to have a brief summary of the how the various
counters mentioned in the "Plugin tail" section of collectd.conf(5)
get reset. Perhaps pointing to types.db(5) and adding a little text
there would be appropriate, or a small COUNTERS section in
collect.conf(5)? The main thing that I was missing that types with a
max of 'U' will keep incrementing, until a reboot. I can't see that
explained anywhere in the documentation at present, but perhaps I
missed it.

Something that confused me further was the issue of counter
wrap-around, discussed in [1].
We have a tail plugin set up to count SSH logins, as in the examples
on [3]. This shows impossibly large positive values, eg 200e6. I think
this was discussed on the list before but [1] seems to suggest this
should not happen any more. Unless ... we had the rrd file created by
an older version of collectd ? We started with 4.3 I think.
The config looks like this (a few matches have been left out for brevity):
 <Plugin "tail">
        <File "/var/log/auth.log">
                Instance "SSH Logins"
               <Match>
                        Regex "sshd[^:]*: Accepted
(password|publickey) for [^ ]+ from"
                        DSType "CounterInc"
                        Type "counter"
                        Instance "Successful Logins"
                </Match>
        </File>
</Plugin>


A separate thing I have found confusing in my reading was
notifications. In THRESHOLD CONFIGURATION it mentions that if a
threshold is exceeded a notification is dispatched.
I'm far from clear what 'dispatched' means, but it says at the top the
section that plugins
can be configured to receive notifications and do something in response.
I think it would help to mention (in THRESHOLD CONFIGURATION) the
names of a couple of plugins that are usually used like this,
particularly if there is one with a worked example.

Cheers
Vince

[1] http://collectd.org/wiki/index.php/Derive. I found that page via [2]
[2] http://collectd.org/wiki/index.php/Plugin:Tail/Config.
[3] http://collectd.org/wiki/index.php/Plugin:Tail