[rrd-users] Re: How to differ spikes from real traffic

Mark Rowlands mark.rowlands at minmail.net
Fri May 31 21:27:52 MEST 2002

On Monday 27 May 2002 9:17 am, Gerhard Ecaroh Froehlich wrote:
> Hi,
> i've set up RRDTool (SNMP) and everything works fine. So me too has some
> spikes in the graphs. But most of them are looking like there just heavy
> traffic when copying large files or databases. So how can i differ short
> heavy network traffic from spikes? Should i imagine a real spike as
> "single" line up or can there be 2,3 or 4 upgoing lines around? Are there
> other ways to differ real traffic from sudden spikes?
> I feel this is difficult cause our network is pretty good and consists
> mainly of routers and switches and therefor is capable of transfering up to
> 100 MBit (Gigabit lines too). Interfaces are allmost all SunQuad NIC. And
> it's not easy to track down whether a cron made a backup or it's just
> another machine in that bunch of hundreds of servers doing something other.

Well I am loath to throw the spikes away, they may be evidence that something 
you don't know about is going on..... on the otherhand they can also disguise 
the normal pattern of data.

I usually use two graphs, one that sets  a cap on or around the max expected 
usual value (-u 200 -r ) and one that is unlimilted to alert me for  unusual 

The other  (better?) option to "hide" the odd data is in the friendly 
manual..... see the cdef tutorial

Unsubscribe mailto:rrd-users-request at list.ee.ethz.ch?subject=unsubscribe
Help        mailto:rrd-users-request at list.ee.ethz.ch?subject=help
Archive     http://www.ee.ethz.ch/~slist/rrd-users
WebAdmin    http://www.ee.ethz.ch/~slist/lsg2.cgi

More information about the rrd-users mailing list