Thoughs on monitoring?

[VVelox]

trafficstars

Begun working on stats monitoring for CAPEv2 would love a bit of input.

Extend: https://github.com/librenms/librenms-agent/blob/master/snmp/cape

In work LibreNMS bits: https://github.com/VVelox/librenms/tree/cape

Example output from a time period in with a single run below. But keeps track of run stats aggregate and by package.

The log line counting is basically for alert monitoring purposes, to enable alerting when something that needs looked into happens alerting when it happens. INFO and DEBUG are just counted as I figured I may as well since the data was being chewed through already and it was no extra work.

That said would min, max, median, range, mean, median, mode, variance, stddev, variancep, and stddevp be of interest to any one for any of this data?

{
  "data": {
    "anti_issues": 2,
    "api_calls": 4331,
    "banned": 0,
    "completed": 0,
    "crash_issues": 0,
    "critical": 0,
    "criticals": [],
    "debug": 0,
    "distributed": 0,
    "domains": 0,
    "dropped_files": 1,
    "error": 0,
    "errors": [],
    "failed_analysis": 0,
    "failed_processing": 0,
    "failed_reporting": 0,
    "files_written": 1,
    "info": 10,
    "packages": {
      "exe": 1
    },
    "pending": 0,
    "pkg_stats": {
      "exe": {
        "anti_issues": 2,
        "api_calls": 4331,
        "crash_issues": 0,
        "domains": 0,
        "dropped_files": 1,
        "files_written": 1,
        "registry_keys_modified": 0,
        "running_processes": 1,
        "signatures_alert": 0,
        "signatures_total": 5
      }
    },
    "recovered": 0,
    "registry_keys_modified": 0,
    "reported": 1,
    "running": 0,
    "running_processes": 1,
    "signatures_alert": 0,
    "signatures_total": 5,
    "timedout": 0,
    "total_tasks": 1,
    "warning": 0,
    "warnings": []
  },
  "error": 0,
  "errorString": "",
  "version": 1
}

[VVelox]

So strongly sided with min, max, range, mean, median, mode, stddev, and and stddevp for aggregate and per package for each 5 minute interval.

For graphs will be both will be present. One for over time for the aggregate and one for at that points based on the numbers then.

[kevoreilly]

Sounds awesome