[rrd-developers] Command-line detection of anomalies

[Mark Plaksin]

Tobias Oetiker <tobi at oetiker.ch> writes:

> Hi Mark,
>
> Today Mark Plaksin wrote:
>
>> Hi:
>>
>> I'd like to be able to detect anomalies via the command-line.  I have
>> begun to explore Holt-Winters, PREDICT, etc.  They can all display
>> anomalies in a graph.  But I think Holt-Winters is the only one that
>> will let me get at the data on the command-line via rrdfetch.  Is that
>> true?
>>
>> Maybe this question is essentially the same as my previous question
>> about getting graph data without the graph [1] :)  In that thread Dan
>> Cech mentions using rrdgraph in "report" mode.  But IIUC you can't
>> report a series of numbers, just a single number.  That is, you can't
>> print the result of a DEF or a CDEF.
>>
>> Am I missing anything?  Are there any plans to make it easier to get at
>> raw data?  I think the prediction and anomaly-detection features would
>> get used more if they could be scripted.  As is, I can't possibly look
>> all of the graphs once a day (or week or month :) to find anomalies.
>>
>> And, of course, thanks for rrdtool--it's awesome!
>
> the trick is to use rrdtool updatev then you will see what data
> gets added to the HW RRAs as it happens ...

Cool!  Thanks!  I'll try it out.

It looks like PREDICT would do a good enough job of spotting anomalies
and it doesn't require that we rework every RRD file.  So I was hoping
for a way to get at PREDICTions via the command-line.  I realize that
using PREDICT would require that we "draw a graph" for every data point
once every day (or however often we wanted to detect anomalies).  But it
still might be cheaper than HW.

Are all of the (many! :) existing anomaly-detectors using Holt-Winters?
Or maybe using their eyeballs?