For our manually created network traffic items, we created calculated items to collect the total incoming and outgoing traffic. We did this in Chapter 10, Advanced Item Monitoring. While we could go ahead and create such calculated items manually for all LLD-created items, too, that would necessitate a huge amount of manual work.
Let's try to create a calculated item per interface according to the LLD rule instead. Go to Configuration | Templates, click on Discovery next to C_Template_Linux, and then click on Item prototype next to Interface discovery. Then, click on Create item prototype. Fill in the following values:
- Name: Total traffic on $1
- Type: Calculated
- Key: calc.net.if.total[{#IFNAME}]
- Formula: last(net.if.in[{#IFNAME}])+last(net.if.out[{#IFNAME}])
- Units: B
When done, click on the Add button at the bottom. If you check the latest data page, this item should start gathering data in a couple of minutes.
But let's say we're not that interested in very detailed statistics on the total traffic, but more in a longer-term trend. We could modify the item we just created to collect the sum of average incoming and outgoing traffic over the past 10 minutes and do so every 10 minutes. Let's go back to Configuration | Templates, click on Discovery next to C_Template_Linux, and then click on Item prototype next to Interface discovery. Then, click on Total traffic on {#IFNAME}. Change these four fields:
- Name: Total traffic on $1 over last 10 minutes
- Key: calc.net.if.total.10m[{#IFNAME}]
- Formula: avg(net.if.in[{#IFNAME}],10m)+avg(net.if.out[{#IFNAME}],10m)
- Update interval: 10m
When done, click on the Update button at the bottom. We now have to allow a couple of minutes for the discovery rule to run again and then up to 10 minutes for this item to get the new value.
Let's discuss the changes we made. The most important one was the Formula update. We changed the last() function for both item references to avg(). We can use any trigger function in calculated items. We also supplied a parameter for this function after a comma, and that was the reason we had to double-quote item keys in the disk space item. The referenced keys contained a comma. That comma would be misunderstood by Zabbix to separate the item key from the function parameters.
If we only want to display the total on a graph, there is no need to create an item – stacked graphs allow us to do that. We discussed stacked graphs in Chapter 21, Visualizing Data with Graphs and Maps.
The total traffic item (or items) should be updated in the latest data to display the average total traffic over the past 10 minutes. Normally, we would probably use an even longer interval for these averages, such as one hour, but 10 minutes supplies us with the data a bit more quickly. This approach could also be used to configure a floating average for an item. For example, a formula such as this would calculate the floating average over 6 hours for the CPU load:
avg(system.cpu.load,6h)
Calculated items do not have to reference multiple items; they can also reference a single item to perform a calculation on it. Such a floating average could be used for better trend prediction or for writing relative triggers by comparing current CPU load values to the floating average.