[mrtg] Strange graph values

[Steve Shipway]

> I would expect the max data value to be constant for all the graphs
> daily, weekly, monthly yearly. Instead I have daily=96MB, weekly= 24.6
> MB monthly = 11.4MB - this can't be right???

No, this is right.  It's the difference between max(peak(x)) and max(avg(x)).

If you compare the Maximum of the PEAK lines, then these should be roughly the same for a weekly graph as for a daily graph, since peak(x) is the max value of x in the 6 samples that make up a weekly CDP (consolidated datapoint).  So, max(peak(x)) in a weekly graph will be about the same as max(x) in the daily, as peak(x) is the max over the 6DP that make up the 1CDP.  Of course, it may be higher, as a week ago there may have been a bigger spike than occurred yesterday.

HOWEVER, if you compare max(x) on a weekly graph to max(x) on a daily graph, this will likely be lower. This is because

Max[weekly](x) = max(cdp(x)) = max(avg[6dp](x))

Where the weekly graph is displaying CDP which are averages of 6DP (the daily graph just displays the DP without change).  This means that the weekly graph (and the higher graphs, to a greater extent) is 'smoothed out' and peaks flattened.  When you take the max of this, it will necessarily be less than the max in the daily graph.

Unfortunately ascii is not the best medium for writing complex statistical calculations.  If you have the MRTG book, check out section 6 in Chapter 2 for some more discussion on this.

This behaviour affects 95th Percentile calculations even more heavily; the latest RRDTool 95th Percentile functionality avoids this, but as thisis only available with later RRDTools installations it is not generally used.  It also requires you to manually modify the RRD files.

The Routers2 software attempts to avoid this counterintuitive behaviour by calculating the 'max' values in the legends of weekly graphs by in fact taking max(peak(x)) which is more what you would expect; this though confuses people as they see a max value that is higher than the highest value the graph reaches.

Steve