Influence of update interval on logrt.count

[troffasky]

I am counting number of lines in a log file that contain the string "TPMS". I have two items:
logrt.count[/tmp/rtl433.json,TPMS,,,skip] with an interval of 1s
and

logrt.count[/tmp/rtl433.jso.,TPMS,,,skip] with an interval of 60s
I just added the latter version of the item, my thinking behind this is that I do not need such granular data here, a count over the past minute would be adequate for my not-statistically-rigorous analysis of traffic in the neighbourhood.

Graphing them together and looking at the hits:



I don't understand why my 1s interval item seems to graph so much smaller than my 60s interval item. These are the relevant log entries:

{"time" : "2020-12-25 22:00:44", "model" : "Abarth 124 Spider", "type" : "TPMS", "id" : "0cb55cd4", "flags" : "05", "pressure_kPa" : 238.740, "temperature_C" : 14.000, "status" : 80, "mic" : "CHECKSUM"}
{"time" : "2020-12-25 22:00:44", "model" : "Abarth 124 Spider", "type" : "TPMS", "id" : "0cb55cd4", "flags" : "05", "pressure_kPa" : 238.740, "temperature_C" : 14.000, "status" : 80, "mic" : "CHECKSUM"}
{"time" : "2020-12-25 22:00:44", "model" : "Abarth 124 Spider", "type" : "TPMS", "id" : "0cb55cd4", "flags" : "05", "pressure_kPa" : 238.740, "temperature_C" : 14.000, "status" : 80, "mic" : "CHECKSUM"}
{"time" : "2020-12-25 22:33:38", "model" : "Ford", "type" : "TPMS", "id" : "66a6f7bb", "code" : "7c024b", "mic" : "CHECKSUM"}
{"time" : "2020-12-25 22:33:42", "model" : "Ford", "type" : "TPMS", "id" : "66a5fb2e", "code" : "78bd4b", "mic" : "CHECKSUM"}
{"time" : "2020-12-25 22:33:42", "model" : "Ford", "type" : "TPMS", "id" : "66a5fb2e", "code" : "78be4b", "mic" : "CHECKSUM"}
{"time" : "2020-12-25 22:33:42", "model" : "Ford", "type" : "TPMS", "id" : "66a5fb2e", "code" : "78bf4b", "mic" : "CHECKSUM"}
{"time" : "2020-12-25 22:33:42", "model" : "Ford", "type" : "TPMS", "id" : "66a5fb2e", "code" : "78cb4b", "mic" : "CHECKSUM"}

Can anybody explain this to me?

[Hamardaban]

I think that item60 counted you the old values without paying attention to "skip".
If you are working with an older version of the agent, you may need to upgrade.
IMHO working with logs is full of oddities and complex dependencies. read the documentation section https://www.zabbix.com/documentation...mportant_notes

[Semiadmin]

I suppose it's just a visualization. Look at the legend, you can see max 5 on both graphs.
But a green graph has much more (60 times) values than a red one, so there are many values by one pixel in the green graph, one value 5 and several values 0.
So a graph shows the average value of them.
There are only 4 lines in 22.33.42, so maybe max 5 on a green graph applies to an earlier time, probably 21.57.

[troffasky]

I don't understand why my 1s interval item seems to graph so much smaller than my 60s interval item.

Because the 1s items are next to each other, rather than stacked one above the other.
It does lead to wildly different average values, however - two orders of magnitude difference:



Which average is correct? Perhaps taking the mean of a series of impulses is irrelevant, so they're both nonsense?

[troffasky]

Another thing, zooming out to a week's worth, the graph is even less useful: