Bytes received not displaying correct sum aggregated over 1h on dashboard graph

[tyfius]

I am trying to create a graph to plot the daily network traffic of a Docker container, ideally on an hourly based schedule, but I'm having trouble on how to do this.

The Docker by Zabbix agent 2 template outputs a few network related items, as a Dependent Item: Networks bytes received per second and Networks bytes sent per second. These are retrieved from the Docker stats item, which is reporting the correct value. I can manually verify that when running docker stats on my host machine.

From the template I can see that these items have 2 preprocessing rules:

1. JSONPath: $.networks
2. .rx_bytes.sum()
3. Change per second

When I test these rules against a Docker container, I can see that they are indeed reporting the correct values. As an example, I used a Docker container of PyLoad to download an Ubuntu Server 20.04 LTS image, which is around 1.2GB in total size.

I can see this reported by Docker stats:

The value of the Docker Stats item in Zabbix is as follows:

{"cpu_stats":{"cpu_usage":{"total_usage":10320909470,"percpu_usage":[3588633075,679756711,1557244774,594896417,2078058954,1822319539],"percent_usage":0.12127799999999998,"usage_in_kernelmode":5570000000,"usage_in_usermode":4680000000},"system_cpu_usage":1346673450000000,"online_cpus":6,"throttling_data":{"periods":0,"throttled_periods":0,"throttled_time":0}},"precpu_stats":{"cpu_usage":{"total_usage":10319696690,"percpu_usage":[3587420295,679756711,1557244774,594896417,2078058954,1822319539],"percent_usage":0,"usage_in_kernelmode":5570000000,"usage_in_usermode":4680000000},"system_cpu_usage":1346667450000000,"online_cpus":6,"throttling_data":{"periods":0,"throttled_periods":0,"throttled_time":0}},"memory_stats":{"usage":67784704,"max_usage":1450655744,"stats":{"active_anon":18141184,"active_file":17289216,"cache":18391040,"dirty":0,"hierarchical_memory_limit":9223372036854771712,"hierarchical_memsw_limit":0,"inactive_anon":17977344,"inactive_file":950272,"mapped_file":1351680,"pgfault":41151,"pgmajfault":198,"pgpgin":635877,"pgpgout":622571,"rss":35917824,"rss_huge":0,"total_active_anon":18141184,"total_active_file":17289216,"total_cache":18391040,"total_dirty":0,"total_inactive_anon":17977344,"total_inactive_file":950272,"total_mapped_file":1351680,"total_pgfault":41151,"total_pgmajfault":198,"total_pgpgin":635877,"total_pgpgout":622571,"total_rss":35917824,"total_rss_huge":0,"total_unevictable":0,"total_writeback":540672,"unevictable":0,"writeback":540672},"failcnt":0,"limit":33677344768,"commitbytes":0,"commitpeakbytes":0,"privateworkingset":0},"name":"/dl-pyload","id":"077d676c5c3f3862c1a2bb48bc59e564e0bc46c828792fb8ee1e68cb155af38b","networks":{"eth0":{"rx_bytes":1283735192,"rx_packets":231360,"rx_errors":0,"rx_dropped":0,"tx_bytes":10652131,"tx_packets":138028,"tx_errors":0,"tx_dropped":0,"endpoint_id":"","instance_id":""}}}

Important here is the following value:

rx_bytes: 1283735192

When testing this against rule #1 it produces the correct value:


The graph of this item is as follows:

Which I assume is correct. As the value is change per second, I would assume that the total values of each second would, over the period of roughly 3 minutes it took to download the file, total up to the expected 1.2GB.

Now, I would like a graph on my dashboard that displays hourly summed total of the network bytes received per second. So, for 22:00 - 00:00 it should display a value of 1.2GB in a bar chart. I would have assumed that taking the sum() over 1h would do the trick, but unfortunately it's not outputting the desired result.

So, my question is fairly simple, yet the answer eludes me: can I, by simply using this value, plot the desired result on a graph? If not, how would I proceed?

[ISiroshtan]

Hi there.

Change per second is definitely a wrong data to use here.

Lets say you collect data once every minute. What Zabbix does is: take current absolute value, substract old absolute value, divide by polling interval(by 60 if you check every minute). Now is you do sum() of 1 hour of said values, you only get (average per-second * 60) which is nowhere near to full data downloaded.

I think you can create new item, than in pre-processing do it as simple-change(which will be a record of how many bytes were downloaded in that minute). This way doing the sum of one hour you should get you what you are looking for.

Hope it helps.

[tyfius]

Your anwser put me on the right track.

I've created a dependent item to just get the current received and sent bytes from the Docker stats. So that's returning my 1.2GB.
I've created a calculated item to create a diff between the current last item, and the previous last item, so I can get the difference between those two to calculate the new traffic.

last(//docker.networks.rxtx_bytes_total["{#NAME}"]) - last(//docker.networks.rxtx_bytes_total["{#NAME}"], #2)

When the container restarts, the Docker stats reset, so I can end up with a situation were the value will be negative. (last(0) - last-1(1.2gb) = -1.2GB) To solve this I added a preprocessing step for the range, were I just set the minimum to 0, and leave the max open. On fail I set the value to 0.