topic Re: cpview history values in Firewall and Security Management

cpview history values

cem82 — Thu, 23 Jun 2022 23:54:14 GMT

I'm investigating an issue and wondering are the values that are displayed if they are max value for the 1 min period or average or what is it? I can't seem to find this mentioned in the SK or anywhere.

Thanks

Re: cpview history values

the_rock — Fri, 24 Jun 2022 03:06:19 GMT

I dont know average per se, but I know you can do cpview -t command and then press t again and it will ask you to enter date to see historical values.

Re: cpview history values

cem82 — Fri, 24 Jun 2022 04:44:45 GMT

Hi,

Sorry What I mean is when I do cpview -t and put a time, you can only move forward/back 1 minute value at a time. I'm looking into various spikes so wondering if what I see as the value there is the max across that minute, 1 min average, or the value at exactly the moment in time ie 12:00:00?

Even though the syntax does include second in the time, I have tried that but the same value appears across the whole minute period so a bit misleading

Re: cpview history values

the_rock — Fri, 24 Jun 2022 09:37:38 GMT

I believe its value at that exact time, but I will let someone from CP verify for you.

Re: cpview history values

Timothy_Hall — Fri, 24 Jun 2022 13:21:09 GMT

When I was writing the third edition of my book I looked into this; assuming it hasn't changed in later releases I discovered in R80.30 w/ Gaia 3.10 that the per-minute value reported by cpview in historical mode is the average of two samples taken 30 seconds apart. Here are the relevant pages from my book comparing the historical granularity with sar, which can provide a nice "second opinion" in these types of historical cases:

Re: cpview history values

Arik_Ovtracht — Sun, 26 Jun 2022 06:27:26 GMT

Hi, I am the one responsible for CPview.

The behavior changes between data - it might be the maximum of that minute, average during the minute, a sample done exactly at that time, or even other behaviors (like the one described below).

Unfortunately, we don't yet have a good document to specify this behavior for each metric - but we are working on it. Once we have everything (or at least the most important metrics) mapped, we will release this documentation and I will post about it in Check Mates, so keep an eye out for it.

If you want to find out the behavior for a specific metric, please approach me directly and I will do my best to answer.