[rrd-users] Re: CF type help

[Alex van den Bogaerdt]

On Wed, May 04, 2005 at 09:30:51AM -0400, Tuc wrote:

> 	I recently needed to take a look at a program someone wrote here
> a few years ago. I don't know RRDs enough to understand whats happening.
> The data is collected by MRTG every 5 minutes. The program then does
> a RRDs::fetch of "MAX" for the timeframe needed. It pushes the results
> into a Statistics::Descriptive::Full . It then takes the 95th% of it.
> It does the same thing again, but this time does an RRDs::fetch of the
> "AVERAGE", pushes the results and takes the 95th. Then it does :
> 
> 	(AVERAGE+AVERAGE+MAX)/3
> 
> 	for the results.
> 
> 	Does anyone have a clue why? Shouldn't this just be the 95th of
> the MAX?

You should probably look at the documentation of this program,
or ask the programmer/coder.  Obviously the programmer did something
on purpose, perhaps you didn't figure out what exactly, or why.


>          I guess I also still don't understand what the MAX is. I thought
> a sample was a sample and thats the end of that. How do you get the
> average sample, or the max sample?

Consider the following samples and times:

00:00 to 00:05   rate 60000 max 60000
00:05 to 00:10   rate 0 max 0
00:10 to 00:15   rate 0 max 0
00:15 to 00:20   rate 0 max 0
00:20 to 00:25   rate 0 max 0
00:25 to 00:30   rate 30000 max 30000

The average here is (5 minutes at 60,000 bytes per second + 5 minutes
at 30,000 bytes per second, rest zero) in (30 minutes * 60 seconds) =
(300*60,000+300*30,000 bytes)/(30*60 seconds) = 27000000B / 1800s = 
15,000 bytes per second.

00:00 to 00:30   rate 15000 max 60000

The average, seen over 30 minutes, differs from all 6 averages used
to calculate this average. The maximum seen in this 30 minute period
is still 60,000 when computed from these samples.

avg_large = avg(all averages)
max_large = max(all maxima)

When intervals are consolidated, the difference between average and
maximum usually gets bigger.  Perhaps the programmer compensated for
this using a formula where averages and maxima are both counting, in
a 2:1 ratio.  It somewhat smoothens the resulting graph, just as the
95th percentile does.


About averaging averages:

At 300 seconds per interval:
  00:05   rate 60000, 300 seconds, amount = 18000000
  00:10   rate 0, 300 seconds, amount = 0
  00:15   rate 0, 300 seconds, amount = 0
  00:20   rate 0, 300 seconds, amount = 0
  00:25   rate 0, 300 seconds, amount = 0
  00:30   rate 30000, 300 seconds, amount = 9000000

  Total: 27000000 bytes
  Max seen: 60,000 per second

At 1800 seconds per interval (computed from above)
  00:30   rate 15000, 1800 seconds, amount = 27000000

  Total: 27000000 bytes
  Max seen: 60,000 per second (and not 15,000)

Average rate multiplied by time is the amount of bytes sent.
This is 27000000 in both examples.  You can't do this with maxima.

HTH
Alex

--
Unsubscribe mailto:rrd-users-request at list.ee.ethz.ch?subject=unsubscribe
Help        mailto:rrd-users-request at list.ee.ethz.ch?subject=help
Archive     http://lists.ee.ethz.ch/rrd-users
WebAdmin    http://lists.ee.ethz.ch/lsg2.cgi