Wandering Thoughts archives


The magic settings to make a bar graph in Grafana

Suppose, not hypothetically, that you want to make a Grafana panel that shows a bar chart (or graph), because bar charts are a great way to show a summary of something instead of getting lost in the details of a standard graph over time. Grafana fully supports this, but exactly how you do it is sufficiently non-obvious that I've now forgotten and had to re-discover it at least twice now. So now I'm writing it down so I can find it again.

(This is sort of covered in the documentation, but you have to know where to look and part of it isn't clear.)

Bar charts aka bar graphs are a form of graph, so they fall under the 'graph' panel type. Although current versions of Grafana have a bar gauge panel type, you probably don't want to use it for this and it's certainly currently not the normal approach. To create a bar graph, you want three settings together:

  • In the 'Query' tab, set the duration of each of your queries to 'instant' and leave the format for each of your queries as the default of 'time series'.

  • In the 'Visualization' tab, set the draw mode to 'bars' instead of anything else, then the crucial magic step is to set the X-axis mode to 'series' instead of the default of 'time'. Since we're doing an instant query, the X-axis 'value' can be left at 'total' or changed to 'current' to be clearer.

    (I believe that if you did a non-instant query, the various options for 'value' here would determine what value the bars showed for each separate series.)

If you set the query to be instant but change nothing else, you get an empty or almost entirely empty graph (with the actual values maybe visible on the far right, since 'instant' is also 'right now'). If you also switch the draw mode to 'bars', you get your single bar value for each series smeared across the entire graph, which looks rather confusing.

I was going to gripe about Grafana not deducing that you want a bar graph when you set an instant query, but there are enough moving parts here that it's not that simple. Even with an instant query you could perhaps do a histogram X-axis instead of a bar graph, for example. I wish Grafana at least put up a warning to the effect that this combination doesn't make any sense and you want to change the X-axis mode.

PS: If you set the X-axis mode to series but don't change the draw mode to 'bars', you get dots (or points) at the top of what would be each bar. This might be what you want but probably not. You can set multiple draw modes, which will give you things like bars with points at the top.

sysadmin/GrafanaMakeBarGraph written at 23:08:29; Add Comment

The browsers are probably running the TLS show now

The news of the time interval is that Apple is limiting TLS certificate lifetimes to 398 days for certificates issued from September 1st onward (also, also). This effectively bypasses the CA/Browser Forum, where Google put forward a ballot on this in 2019 but couldn't get it passed (also). Specifically, it was voted down by a number of CAs; some CAs voted in favor, as did all browser vendors. Now Apple has decided to demonstrate who has actual power in this ecosystem and has simply put their foot down. What CAs want and how they voted is now irrelevant.

(Since Apple has led the way on this and all browser vendors want to do this, I expect Chrome, Firefox, and probably Microsoft Edge to follow before the end of the year.)

I wouldn't be surprised if other developments in TLS start happening this way (and if it was Apple driving them, because Apple is in some ways in the best political position to do this). At the same time it's worth noting that this is a change from how things used to be (as far as I know). Up until now, browser vendors have generally been fairly careful to build consensus and push CAs relatively lightly. If browser vendors are now going to be more aggressive about simply forcing CAs to do things, who knows what happens next.

At the same time, shortening the acceptable certificate validity period is the easiest change to force, because everyone can already issue and get shorter-lived certificates. The only way for a CA to not 'comply' with Apple's new policy would be to insist on issuing only long-lived certificates to customers against the wishes of the customers, and that's a great way to have the customers pack up and go to someone else. This is fundamentally different from a policy change that would require CAs to actively change their behavior, where the CAs could just refuse to do anything and basically dare the browser vendors to de-trust them all. On the third hand, Google more or less did force a behavior change by increasingly insisting on Certificate Transparency. Maybe we'll see more of that.

(And in a world with Let's Encrypt, most everyone has an alternative option to commercial CAs. At least right now, it seems unlikely that a browser vendor would try to force a change that LE objected to, partly because LE is now such a dominant CA. Just like browsers, LE is sort of in a position to put its foot down.)

web/BrowsersRunningTLSNow written at 00:25:31; Add Comment

Page tools: See As Normal.
Login: Password:
Atom Syndication: Recent Pages, Recent Comments.

This dinky wiki is brought to you by the Insane Hackers Guild, Python sub-branch.