Re: list of cfenvd classes?

[Mark Burgess]

On Fri, 2005-02-11 at 14:40 -0500, nathan r. hruby wrote:
> Hi,
> 
> I've searched the docs but seem unable to find this, if there is a doc,
> please point me at it!
> 
> What I have is a particular shellcommand that I'd like to run only if the
> box is lightly loaded at various points in time.  In theory cfagent+cfenvd
> should be able to do this, I think, simply like so:
> 
> shellcommands:
>          SomeServiceClass.EvenHour.!loadavg_high_dev1::
>                  "${scripty} -o --option --other=option"
> 
> Sadly I can not confirm, nor deny, that there would be a loadavg_high_dev1
> class exported by cfenvd.  Is there a authoritative list of everything
> that cfenvd may at any time export that I could reference?  This would
> probably be easier than experimenting by DoS'ing my own box :)  I did poke
> at cfenvd's sources, but I'm unfamiliar enough with C and cfengine's
> sources that my list would probably not be accurate.
> 
> Thanks!
> 
> -n
> 
> 

Nathan - thanks for pointing out this weakness in the documentation.
Yes, you are right. This might work, depending on the variation you
observe in load average. 

Clearly there is some work to do ont he anomaly documentation.

Cfengine classifies into 3 levels:

dev1       > 1 std dev
dev2       > 2 std dev

normal     < 1 std dev
anomaly    > 3 std dev

(There is also something called a microanomaly if the sensitivity is too
high...but I should explain that another time,)

The firts part of the string is from the list

Users
RootProcs
UserProcs
DiskFree
LoadAvg

netbiosns     # from ECGSOCKS globals.c
netbiosdgm",
netbiosssn
irc
cfengine
nfsd
smtp
www
ftp
ssh
wwws

   "icmp",  #From TCPNAMES in globals.c
   "udp",
   "dns",
   "tcpsyn",
   "tcpack",
   "tcpfin",
   "misc"


then, as you say, there is _high_ or _low_ and then dev1,dev2, or
anomaly