[rrd-developers] Re: RRD support for aberrant behavior detection

[Jake Brutlag]

> From: Tobias Oetiker [mailto:oetiker at ee.ethz.ch]
> Two questions I was not quite clear about:
> 
> Is your code backward compatible in the sense that It will create a
> version 1 RRD if none of the Prediction RRAs are defined ?

The short answer is yes. On disk, new RRAs conform to the format of old RRAs
(they
basically exploit extra space in the rra_def.param[] and cdp_prep.scratch[]
arrays,
but do not alter their length). The only difficulty is in dump and restore,
because
the current (version 1) format does not export or read the contents of
rra_def.param[] and cdp_prep.scratch[]. So on creation, the new code will
mark the file as version 1
if none of the new RRAs are included (including the new RRAs bumps up the
version to 2,
as the old code cannot handle the new RRAs). But on dump, it will upgrade
the version to 2
because that is the format used by the new code.
 
> When I want to use the aberrant Behavior detection in an automagic
> way, I can fetch data from the apropricate RRA and use it generate
> alerts or calculate an interestingnes parameter for a graph in
> order to generate jeffs 'page of interesting graphs' ?

You are correct that RRDtool cannot generate alerts on its own. We are
making
some changes to the Cricket module Monitor.pm for version 1.1.x to include
this 
functionality. Basically, Cricket can fetch values from the FAILURES RRA and
use its existing monitoring capabilities (which are being improved
indepedently of this 
project for Cricket 1.1.x).

Jake Brutlag
Network Analyst
Microsoft WebTV