MRTG

Stands for: Multi Router Traffic Grapher, Tobias Oetiker's SNMP traffic grapher of 1995

The Multi Router Traffic Grapher, Tobias Oetiker's free SNMP tool that polls two counters every five minutes and draws the daily, weekly, monthly and yearly traffic graphs that became the universal picture of a busy link.

MRTG was born of one slow link. In Oetiker's own account to the LISA conference of December 1998, in the summer of 1994 De Montfort University in Leicester had one 64 kbit Internet link for more than a thousand networked computers and could not get a faster one for another year, so he wrote a tool that queried the gateway router's octet counters every five minutes, derived the average transfer rate for each interval and generated a web page with four graphs showing the rates for the last day, week, month and year. The graphs did not make the link faster, but they were, he wrote, a key argument to convince management that a faster link was needed. Published on the Internet in spring 1995, it spread quickly; Dave Rand contributed a small C program called rateup that moved the heavy work out of the Perl script, and after a year of beta testing MRTG-2.0 was released in January 1997 under the GNU GPL. The RRD Tool that grew out of it became the time-series store behind a generation of monitoring.

How it works. MRTG uses SNMP, the Simple Network Management Protocol, to send a request carrying two object identifiers to a device; the device looks them up in its management information base and returns the raw counter values, typically the octets in and out of an interface. MRTG records the values in a log beside the previous readings, computes the rates, and writes an HTML page per target with four graphs, GIF or PNG, plotting the two values against time over a day, a week, a month and a year, the inbound as a filled green area and the outbound as a blue line. It can also run a script instead of an SNMP query and graph whatever integer the script prints, which is how MRTG ended up graphing CPU fan speeds and firewall rule hits. The Y axis scales itself; the page carries the maximum, average and current values; thresholds can send warning mail. It is written in Perl and runs on Windows, Linux, Unix, Mac OS and NetWare.

The design decision that mattered. MRTG logged its data to an ASCII file that it rewrote every five minutes, consolidating older readings so the file never grew. That consolidation is why the yearly graph is coarse and the daily graph is fine, and it is the idea that Oetiker's Round Robin Database Tool later generalised: a store of fixed size in which old data loses resolution instead of taking space. RRDtool, Cacti and Munin all stand on it.

The history, from the author's paper. The original MRTG was a Perl script that called external utilities to do the SNMP queries and to create the GIF images. Once it spread in 1995, users reported two problems, scalability and portability. Dave Rand's rateup, in C, took over the two most processor-intensive tasks; the SNMP portability problem was solved by switching from CMU's snmpget to Simon Leinen's pure-Perl SNMP module, which to Oetiker's surprise worked under Windows NT without change. The result of almost a year of beta testing was MRTG-2.0 in January 1997, available under the terms of the GNU GPL. The paper was presented at LISA XII in Boston, 6 to 11 December 1998, by which time MRTG-3 and the RRD Tool were already in development.

Why the entry exists. Before dashboards, there was the MRTG page: a wall of green-and-blue graphs that every network operations centre of the late 1990s and 2000s kept open, and that told you at a glance when a link filled. PRTG took its name from it, Cacti took its database, and every traffic graph on every modern tool is a descendant. The author's own career in networking began in the year the tool was published, which is reason enough for it to be here.

Also known as: multi router traffic grapher, mrtg graphs, oetiker, rrdtool

Sources

← All glossary entries