[mrtg] Re: mrtg & rrdtool & max values

[Alex van den Bogaerdt]

Josh Parker wrote:

> > There are no 5 minute peak values. There are 5 minute average values.
> > And then there are "30 minute average values" and the 
> > "maximum of the 5
> > minute average values of 30 minutes" and so on.
> 
> Something I've been wondering, then...  In the MRTG logfiles, after the
> first line it's got entries for avg in/out and max in/out for the 5 minute
> intervals for like 600 lines and then the time increment increases after
> that.

This has to do with interpolation of the data.  If collecting the stats
does not occur at exact 5-minute intervals, MRTG needs to interpolate.
Suppose you are monitoring not at 00:00, 00:05, 00:10 but one minute later:

Time t is some MRTG boundary (for instance, midnight).

time      value
t+00:01   10000
t+00:06   13000  (we now know interval A, from t+1 to t+6)
t+00:11   16000  interval B; t+6 to t+11
t+00:16   46000  interval C; t+11 to t+16

Look at the intervals:
Interval A has an average rate of (13000-10000)/300 = 10
Interval B has an average rate of (16000-13000)/300 = 10
Interval C has an average rate of (46000-16000)/300 = 100

MRTG needs to shift these rates into normalized time slots:

time
t+00:00
t+00:05   in this example we cannot calculate the rate
t+00:10   interval D: the rate comes from intervals A and B, see below
t+00:15   interval E: the rate comes from intervals B and C, see below

Interval D is calculated partially from interval A and partially from
interval B.  The time range t+00:05 to t+00:06 is inside interval A.
The time range t+00:06 to t+00:10 is inside interval B.  Take 20% from
the rate of interval A and 80% from the rate of interval B.  Sum this
to get the new *average* rate D.  However, the *maximum* rate seen is
still max(A,B).  In this example it doesn't matter.  Both intervals
have an average of 10; max(10,10) is 10.

This is different for interval E:
the rate for interval E = 20% * 10 + 80% * 100 = 82.  max(10,100)=100
so the average will be 82 while the maximum is 100.

> Thanks for the insight.  It's been sticking in my brain too long.

Unfortunately this is of no use in the near future.  Tobi decided to
always average before max in the new back end.  That means that the
previous example would not have produced a different maximum value
for interval E.

HTH
-- 
   __________________________________________________________________
 / alex at slot.hollandcasino.nl                  alex at ergens.op.het.net \
| work                                                         private |
| My employer is capable of speaking therefore I speak only for myself |
+----------------------------------------------------------------------+
| Technical questions sent directly to me will be nuked. Use the list. | 
+----------------------------------------------------------------------+
| http://faq.mrtg.org/                                                 |
| http://rrdtool.eu.org  --> tutorial                                  |
+----------------------------------------------------------------------+

--
Unsubscribe mailto:mrtg-request at list.ee.ethz.ch?subject=unsubscribe
Archive     http://www.ee.ethz.ch/~slist/mrtg
FAQ         http://faq.mrtg.org    Homepage     http://www.mrtg.org
WebAdmin    http://www.ee.ethz.ch/~slist/lsg2.cgi