General collectl discussions ()

kkruzich | 28 Jun 2011 23:30

using --from "No files processed"


I don't understand why this isn't working. What are the cases where I 
should be getting "No files processed?"

On some of the raw files I can do this playback, on others I cannot. 
I've verified the timespan is valid by doing, for example...

# collectl -sc -oT -p dingo-20110626-235959.raw.gz | head -n20
#         <--------CPU-------->
#Time     cpu sys inter  ctxsw
00:00:10   29  10   155    420
00:00:20   22   4   114     98
00:00:30    0   0     9     13
00:00:40    0   0    50     14
00:00:50    0   0     9     13
00:01:00    0   0    11     19
00:01:10    4   0    55     50
00:01:20    0   0    10     14
00:01:30    0   0     8     13
00:01:40    0   0    12     21
00:01:50    0   0     9     14
00:02:00    0   0    11     14
00:02:10    0   0    16     37
00:02:20    0   0    15     22
00:02:30    0   0     8     13
00:02:40    0   0     9     13
00:02:50    0   0     8     12
00:03:00    0   0     9     13

# collectl -sc -oT -p dingo-20110626-235959.raw.gz --from 00:01-00:02

(Continue reading)

headers

Mark Seger | 28 Jun 2011 23:48

Re: using --from "No files processed"

I have an answer but you might not like it.  Can I assume you're using
the latest version?  I recently fixed a bug in which there were issues
with data that crosses midnight and which I fixed or at least think I
did.

The issue is handling defaults, and I really did think hard about this
for all kinds of weird cases and do think I got it right.  If you
think about it for awhile, someone could be processing a file that
contains many days worth of data and the only consistent way I felt to
handle the default was to use that of the file when no date is
specified.

So in your case the file was created just before midnite and so the
default date is 'yesterday' with respect to the time you chose.  If
you want data for 'today', you'd need to say --from 20110626:00:01.

I tried to go into more detail here -
http://collectl.sourceforge.net/Playback.html

If there's any way to make the documentation clearer, I'm all ears.

-mark

On Tue, Jun 28, 2011 at 5:30 PM, kkruzich <kkruzich@...> wrote:
>
> I don't understand why this isn't working. What are the cases where I
> should be getting "No files processed?"
>
> On some of the raw files I can do this playback, on others I cannot.
> I've verified the timespan is valid by doing, for example...

(Continue reading)

headers

kkruzich | 29 Jun 2011 01:03

Re: using --from "No files processed"


Thanks for the explanation. I think I understand the issue but I'm still 
having trouble getting the data. I have collectl V3.5.1-1 
(zlib:2.02,HiRes:1.9721)

---
# collectl -sc -oT -p /var/log/collectl/dingo-20110626-235959.raw.gz 
--from 20110626:00:01-00:02
Use of uninitialized value $fileFrom in subtraction (-) at 
/usr/bin/collectl line 1953, <CONFIG> line 121.

---
# collectl -sc -oT -p /var/log/collectl/dingo-20110626-235959.raw.gz 
--from 20110626:00:01-20110626:00:02
No files processed

---
If I do this

# collectl -sc -oT -p /var/log/collectl/dingo-20110626-235959.raw.gz 
--from 20110626:00:01

I get continuous data like so...

#         <--------CPU-------->
#Time     cpu sys inter  ctxsw
00:00:10   29  10   155    420
00:00:20   22   4   114     98
00:00:30    0   0     9     13
00:00:40    0   0    50     14

(Continue reading)

headers

Mark Seger | 30 Jun 2011 16:00

Re: using --from "No files processed"

> # collectl -sc -oT -p /var/log/collectl/dingo-20110626-235959.raw.gz --from
> 20110626:00:01-00:02
> Use of uninitialized value $fileFrom in subtraction (-) at /usr/bin/collectl
> line 1953, <CONFIG> line 121.

This could be a bug, but also consider that I thought your file had
data for 627, not 626.  Your from switch implies 20110626:00:01 to
20110626:00:02 and you don't have any data between those 2 time.  Of
am I missing something?

Do us both a favor and use -oD with your output so it will show dates
and times.  If possible, could you send a copy of your gz file for me
to play with and try to reproduce this bug?

-mark

------------------------------------------------------------------------------
All of the data generated in your IT infrastructure is seriously valuable.
Why? It contains a definitive record of application performance, security 
threats, fraudulent activity, and more. Splunk takes this data and makes 
sense of it. IT sense. And common sense.
http://p.sf.net/sfu/splunk-d2d-c2