Dstat: plugin-based real-time monitoring

Many tools exist to monitor hardware resources and software behaviour, but few tools exist that allow you to easily monitor any conceivable counter.

Dstat was designed with the idea that it should be simple to plug in a piece of code that extracts one or more counters, and make it visible in a way that visually pleases the eye and helps you extract information in real-time.

By being able to select those counters that you want (and likely those counters that matter to you in the job you're doing) you make it easier to correlate raw numbers and see a pattern that may otherwise not be visible.

A few years ago I was involved in a project that was testing a storage cluster with a SAN back-end using GPFS and Samba for a broadcasting company. The performance tests that were scheduled together with the customer took a few weeks to measure the different behaviour under different stresses.

During these tests there was a need to see how each of the components behaved and to find problematic behaviour during testing. Also, because it involved 5 GPFS nodes, we needed to make sure that the load was spread evenly during the test. If everything went well repeatedly, the results were validated and the next batch of tests could be prepared and run.

We started off using different tools at first, but the more counters we were trying to capture the harder it was to post-process the information we had collected. What's more, we often saw only after performing the tests that the data was not representative because the numbers didn't add up. Sometimes it was caused by the massive setup of clients that were autonomously stressing the cluster. On other occasions we noticed that the network was the culprit. All in all, we lost time because we could only validate the results by relating numbers after the tests were complete and not during the tests.

Complicating the matter was the fact that 5 different nodes were involved and using the normal command line tools like vmstat, iostat or ifstat (which only showed us a small part of what was happening) was problematic as each needed a different terminal. Besides, not all information was interesting.

Eventually Dstat was born, to make a dull task more enjoyable.

After the project was finished I was able to correlate system resources with network throughput, TCP information, Samba sessions, GPFS throughput, accumulated block device throughput, HBA throughput, all within a single interval.

There are many ideas incorporated into Dstat by design, and this section serves to list all of them. Not all of them may appeal to the task you're doing, but the combination may make it an appealing proposition nevertheless.

An important characteristic in tools like vmstat, iostat or ifstat is the fact that you can compare historical collected data with new data. This allows you to have a good feeling of how something is evolving.

Compare this to tools like top or nmon, where data is often being refreshed and you loose historical information.

It was very important that when numbers were compared, they were in the same unit, and not eg. a different power exponent. The human mind sometimes works in mysterious ways and more so when working with numbers for hours and hours. Adding the unit is something very convenient and may reduce the human error factor.

Additionally, indicating the unit also makes sure that the columns have a fixed width. Often when using vmstat or other tools, the columns tend to shift depending on the width of the counter. This makes it very inconvenient to find counters in the shifted output.

After I added colours to help improve indicating unites, I noticed that the colours also helped to show patterns. This of course is very limited, nevertheless it instantly shows when numbers are flat or changes are taking place.

During tests, when you choose to see average values over a given time, it can be useful to see how the averages evolve. Dstat, by default, displays intermediate updates. This means that if you select to see 10 second averages, after each second you see the accumulated average over the timespan. This means that after 4 seconds with intermediate updates, you see an average taken over the 4 second timeframe.

Dstat was specifically designed to enable anyone to add their own counters in a matter of minutes. The plugin-based system takes care of displaying, colouring and adding units to the counters. As a plugin-writer, you only have to focus on extracting the counters from the kernel (procfs or sysfs), logfiles or daemons.

Being able to add custom counters is important, but selecting those counters that you really need is even more important if you want to correlate counters and see patterns. Less is more.

Having information on screen is one thing, you most likely need some hard evidence later to make your case. (Why else do all the work?)

Dstat allows to write out all counters in the greatest detail possible to CSV. By default it also adds the command-line used for generating the output, as well as a date and time stamp. Since Dstat in the first place is meant for human-readable real-time statistics, it will by default also display the counters to screen (unless you /dev/null it).

It may seem a small thing, but having exact time (and date) information for your counters allows for a completely different usage as well. By adding simple date and time information, Dstat can be used as a background process in a screen to monitor the behaviour of your system during the night.

This proves to be very valuable for example, to find offending processes during nightly tasks or to pinpoint their behaviour to certain events that you cannot monitor during working hours.

It is also important when you have multiple Dstats running (eg. for nodes in a cluster) to correlate counters between the outputs.

Dstat also takes into account the width and height of your terminal window and modifies output to fit into your terminal. This, of course, has no effect on what ends up in the CSV output.

Another (debatable) useful feature is that Dstat will modify the terminal title to indicate on what system it was run and what options were used. Especially when monitoring nodes in a cluster, this can be useful, but even in Gnome finding your Dstat window is handy.

When we talk about plugins, we make a distinction between those plugins that are included within the Dstat tool itself, and those that ship with it externally. In essence there is no real difference, as the internal plugins could easily have been created as an external plugin. The basic difference is that the internal plugins have no dependencies except on procfs.

Having the basic plugins as part of Dstat, makes sure that Dstat can be moved as a self-contained file to other systems.

The plugins that have been selected to be part of the Dstat tool itself, and therefor have no dependencies other than procfs, are:

For backward compatibility with older kernels there is a cascading system that selects the most appropriate internal plugin for your kernel. (eg. the dstat_disk plugin falls back to dstat_disk24 and dstat_disk24old) At this moment there is no such system for external plugins.

This basic functionality is easily extended by writing your own plugins (subclasses of the Dstat class) which are then inserted at runtime into Dstat. A set of external modules exist for:

Hoping someone interested reads this document, I added a few plugins that would be “very nice” to have but are currently lacking:

Creative souls with other ideas are welcome as well !

Central to the Dstat command line interface is the selection of plugins. The selection and order of options influence the Dstat output directly.

The internal plugins have short and/or long options within Dstat, eg. -c or —cpu will enable the cpu counters.

The external plugins are enable by a single -M option followed by one or more plugin-names. (This also works for internal plugins)

The following examples will enable the time, cpu and disk plugins, and are equal.

Some of the plugins can show both total values or individual values and therefor have an extra option to influence this decision.

You can show both the individual values and total values as follows:

The special -f or —full option allows to select individual counters by default, and can be overruled by -C, -D, -I, -N or -S.

Dstat has a few more options to influence its output. With the —nocolor one can disable colours. The —noheaders option disables repeating headers. The —noupdate option disables intermediate updates. The —output option is used for writing out to a CSV file.

Dstat looks in the following places for plugins. This allows a user without root privileges to use some extra plugins.

The option -M list shows the available plugins and their location in the order that the plugin search path is used.

Below are some use-cases to demonstrate the usage of Dstat.

Let's say you quickly want to see if the system is doing alright. In the past this probably was a vmstat 1, as of now you would do:

I often run both the dstat_topcpu and dstat_topmem programs on a system, just to see what a system is doing. Having a quick look at what application is using the most CPU over a few minutes and to see what the general usage of memory is of the top application gives away a lot about a system.

Imagine the monitoring team notices strange peaks, a system engineer got a worthless message, the system was swapping extensively, a process got killed.

Something indicates the system is doing something unexpected but what is causing it and why ? As of now you can do:

to see what process is using the most CPU, the most memory and the most I/O resources.

And hopefully one day we can do:

Leave it running during the night and in the morning you can see the light.

Many devices generate interrupts, especially when used at maximum capacity. Sometimes too many interrupts can slow down a system. If you want to correlate bad performance with hardware interrupts, you can run a command like:

In some cases it can be useful to see how many ticks (timer interrupts) your kernel is producing. With older kernels this is a fixed number (usually 100, 250 or 1000) but on newer kernels the number can be dynamic.

Also on VMware virtual machines, the number of ticks can cause clock issues, so in that case if you want to see what is happening, you can simply do:

Dstat nowadays can also detect lost ticks (when the number of ticks do not much the time progress. This is useful to correlate VM issues with other problems.

A nice feature of Dstat is that it can show how many interrupts each of your devices is generating. The cpu stats already show this in percentage as hard interrupt and soft interrupt, and the sys stats shows the total number of interrupts, but the int stats go into detail. And you can specify exactly what IRQs you want to watch.

Much like watch -n1 -d cat /proc/interrupts on speed.

which then results in:

When having the following hardware:

Or select specific interrupts:

Something I was looking into when trying to find the optimal location for the WIFI access point. However I must say that another tool I wrote Dwscan is currently more sophisticated.

You can monitor I/O throughput for any block device. By default dstat limits itself to real block devices to prevent having the same I/O to be counted more than once, but if you want to monitor a SWRAID device, or a multipath device, you can simply do that by doing:

Dstat is completely written in python and this makes it extremely convenient to write your own plugins. The many plugins that come with Dstat are an excellent source of information if you want to write your own.

The following plugin does nothing more than write "Hello world!" to its output.

In this example, there are several components:

The following example shows how information is collected and counters are processed. It also includes a check() method to properly bail out when the system fails to meet some plugin criteria.

This example shows the following items:

Dstat provides its own dopen() function to plugins. Using dopen() instead of open() plugins do not need to reopen files to update their counters. But this is only useful when plugins open a few files. For eg. opening /proc/pid files the number of open files would only be increasing as the number of processes increases.

Dstat provides its own dpopen() function to plugins. This function allows the plugin to open stdin, stdout and stderr pipes for 2-way communication with processes. To see this in action, take a look at the dstat_gpfs plugins or the dstat_mysql plugins.

Piping to an application is more expensive than getting kernel counters from /proc, but it beats having to run a program and capturing the output.

There are some known issues that are important to understand when using Dstat.

Unfortunately Dstat is susceptible for counters that “rollover”. This means that a counter gets bigger than its maximum value the data-structure is capable of storing. As a result the counter is reset.

For some architectures and some counters, Linux implements 32bit values, this means that such counter can go up to 2^32 (= 4294967296B = 4G) values.

For example the network counters are calculated in absolute bytes. Every 4GB that is being transferred over the network will cause a counter reset. For example on a bonded 2x10Gbps interfaces that is using its theoretical transfer limit, this would happen every 1.6 seconds.

Since /proc is updated every second, this would be impossible for Dstat to catch. Currently if Dstat encounters a negative difference for an interval it displays a dash.

Obviously, if Dstat were know what the counter's maximum value is, it could recalculate the difference. However that is currently not implemented and does not guarantee a correct result either, since a negative value could be the result of 2 or more rollovers.

If you suspect that the behaviour of your system is susceptible of counter rollovers, make sure you take this into account when using Dstat (or any other tool that uses these counters for that matter)

As mentioned several times now, Dstat is written in python. There are various reasons that Python was chosen and the most important reason is that it simplifies writing plugins, processing counters and lowers the bar for people to contribute changes.

The downside of choosing a scripting language is that it is slower than if it would be written in C, obviously. Dstat is not optimised for performance.

If we look at the basic plugins, there are no real performance issues with Dstat. Loading Dstat takes longer than eg. vmstat, but once running, Dstat's performance for the same functionality is up to par with vmstat, ifstat and other similar tools.

However there are plugins that are much more resource intensive than others and the selection of plugins determines Dstat's performance in a major way.

Dstat comes with a —debug option that helps to find the cost of running plugins. The —debug option show how long it takes Dstat to process the selected plugins.

You can see the cost of Dstat itself by simply using the dstat_time plugin together with the —debug option.

Compare this with other plugins to see what the cost is of an individual plugin.

As you can see, getting the CPU counters and calculating the CPU usage takes up 0.5 milliseconds on this particular system. But if we look at the usage of the dstat_topcpu plugin:

we see that processing the /proc/pid files causes the topcpu plugin to use an additional 33ms.

Plugins that communicate with other processes or those that process lots of information (eg. communicating with the mysql client, or processing the mail queue) may not actually use any local resources, but the latency causes Dstat to slow down processing other counters.

It makes sense to reimplement Dstat or some of its plugins in C and still allow the writing of Python (or even Perl) plugins. Tests have shown that for example processing /proc/pid in C makes the plugin 3 times faster. And this did not take into account the processing of the results and displaying the output.

So rewriting in C makes a lot of sense, but it is also much more complicated.

Dstat works with python 2.0, however there is also a Dstat15 version that still works on python 1.5. The downside of having Dstat work on python 1.5 is that the external plugins cannot use the newer and more flexible python 2.0 syntax and the differences between python 1.5 and 2.0 are considerable.

The Dstat release contains a TODO file highlighting all the items and ideas that have been played with. Here is a list of the most important ones: