A way to alert suspicous trends?

[Martin Melin]

I haven't implemented this myself but have thought about it:

You should be able to monitor the derivative (rate of change) of most checks
that return performance data.

In your disk example, it would catch that the disk usage has started to
increase substantially faster than historical levels. You'd catch the user
trying to fill his home dir with his MP3 player's contents as well as more
sinister things.

It should be pretty straightforward to hack a proof of concept of this.

I don't see how your second example isn't served by the graphs you get with
pnp4nagios: if your disk usage is increasing slowly but surely and you're
not expecting it to, you'll see it in the graph and can investigate
accordingly when time allows. If your disk usage starts to run critically
low Nagios will let you know as always.

Thoughts?

Regards
Martin Melin

On Tue, Sep 15, 2009 at 1:35 PM, Jelle Smet <nagios at smetj.net> wrote:

> Hi List,
>
> Using the disk check we can see the usage and set thresholds.
> The performance info is stored into a RRD and viewed through pnp.
>
> This all works as expected.
>
> Now that the RRD contains historical data, I was wondering if there are any
> checks or systems available which can detect and and alert on suspicious
> trends.
>
> For example in the case of a disk check.
> If the disk usage increased with 50% over the last 15 minutes, that
> indicates a problem... while this doesn't necessarely mean a threshold is
> exceeded.
> Or if the disk usage is growing steady, we will run out of space in 2 days,
> ... but the coninuous gentle growth indicates a problem (log file appends
> for example)
>
>
>
> Thanks for the info.
>
> Jelle Smethttp://www.smetj.net
>
>
>
> ------------------------------------------------------------------------------
> Come build with us! The BlackBerry® Developer Conference in SF, CA
> is the only developer event you need to attend this year. Jumpstart your
> developing skills, take BlackBerry mobile applications to market and stay
> ahead of the curve. Join us from November 9-12, 2009. Register now!
> http://p.sf.net/sfu/devconf
> _______________________________________________
> Nagios-users mailing list
> Nagios-users at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/nagios-users
> ::: Please include Nagios version, plugin version (-v) and OS when
> reporting any issue.
> ::: Messages without supporting info will risk being sent to /dev/null
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://www.monitoring-lists.org/archive/users/attachments/20090915/0ac4387e/attachment.html>
-------------- next part --------------
------------------------------------------------------------------------------
Come build with us! The BlackBerry® Developer Conference in SF, CA
is the only developer event you need to attend this year. Jumpstart your
developing skills, take BlackBerry mobile applications to market and stay 
ahead of the curve. Join us from November 9-12, 2009. Register now!
http://p.sf.net/sfu/devconf
-------------- next part --------------
_______________________________________________
Nagios-users mailing list
Nagios-users at lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nagios-users
::: Please include Nagios version, plugin version (-v) and OS when reporting any issue. 
::: Messages without supporting info will risk being sent to /dev/null