Values, can be one of:

Derive: used for values where a change in the value since it’s last been read is of interest. Can be used to calculate and store a rate.
Counter: similar to derive values, but take the possibility of a counter wrap around into consideration.
Gauge: used for values that are stored as is.
Absolute: used for counters that are reset after reading collectd consist of a value list.

collectd Data Sets

Values lists are often accompanied by data sets that describe the values in more detail. Data sets consist of:

A type: a name which uniquely identifies a data set.
One or more data sources (entries in a data set) which include:
The name of the data source. If there is only a single data source this is set to “value”.
The type of the data source, one of: counter, gauge, absolute or derive.
A min and a max value.

Examples of types in collectd

Examples of types in types.db:

bitrate value:GAUGE:0:4294967295

counter value:COUNTER:U:U

if_octets rx:COUNTER:0:4294967295,tx:COUNTER:0:4294967295

In the example above if_octets has two data sources: tx and rx.

collectd notifications

Notifications in collectd are generic messages containing:

An associated severity, which can be one of OKAY, WARNING, and FAILURE.
A time.
A Message
A host.
A plugin.
A plugin instance (optional).
A type.
A types instance (optional).
Meta-data.

Notifications and thresholds

https://collectd.org/documentation/manpages/collectd-threshold.5.shtml

Collectd cool features

Exec Plugin

Executes scripts / applications and reads values back that are printed to STDOUT by that program.
Extends the daemon in an easy and flexible way.
Can also be used to call a bash script that does something with the notification from the threshold plugin.

Example of a script used by the exec plugin to write notifications to a file /tmp/notifications :

       <Plugin exec>

       #       Exec "user:group" "/path/to/exec"

               NotificationExec "stack" "write_notification.sh"

       </Plugin>

write_notification.sh just writes the notification passed from exec through STDIN to a file (/tmp/notifications).

       #!/bin/bash

       rm /tmp/notifications

       while read x y

do

         echo $x$y >> /tmp/notifications

       done

an example generated file is shown below:

cat /tmp/notifications contents
 Severity:FAILURE

Time:1472552207.385

Host:pod3-node1

Plugin:dpdkevents

PluginInstance:dpdk0

Type:gauge

TypeInstance:link_status

DataSource:value

CurrentValue:1.000000e+00

WarningMin:nan

WarningMax:nan

FailureMin:2.000000e+00

FailureMax:nan

Hostpod3-node1, plugin dpdkevents (instance dpdk0) type gauge (instance link_status): Data source "value" is currently 1.000000. That is below the failure threshold of 2.000000.

Collectd Plain Text Protocol

Submit statistics and notifications to the daemon as well as query the current value of collected statistics.

Plugins currently using this protocol are Exec (partially) and UnixSock

Filter Configuration

Starting with collectd 4.6 there is a powerful filtering infrastructure implemented in the daemon.
The concept has mostly been copied from ip_tables.
Terminology:
- Match: criteria to select specific values.
- Target: action that is to be performed with data.
- Rule: The combination of any number of matches and at least one target
- Chain: a list of rules and possibly default targets. Rules tried in order and if one matches, the associated target will be called.

Image Added

When "read" plugins call the dispatch functions to dispatch values, the pre-cache chain is run.
The values are then added to the internal cache.
The post-cache chain is run after the values have been added to the cache.
Allows you to remap value names.
The cache is also used to convert counter values to rates.
More info @ https ://collectd.org/documentation/manpages/collectd.conf.5.shtml#filter_configuration

Network plugin

Uses a binary protocol
UDP transport
Sends data to a remote instance of collectd, receives data from a remote instance, or both at the same time.
Data which has been received from the network can be Forwarded again.
It’s possible to sign or encrypt the network traffic.