[rrd-users] what is the alpha value you guys using for aberrant behavior detection?

[John Conner]

Hey guys,

I am using rrdtool with aberrant behavior enabled to monitor the traffic
going through our routers, for HWPREDICT, I just choose the "default"
0.1alpha setting, according to the document, that means the most
recent hour's
data accounts for 75% of the baseline prediction.

Everything runs pretty good, and whenever there is a huge traffic spike
(thus the observed value falls outside the confidence band), there will be
an alert.

But I noticed if the spike persist for a while, seems rrdtool will adopt the
new traffic pattern quickly, the baseline and confidence band will go up
with the spike and a little while there will be no alert (since now rrdtool
thinks this is the normal traffic), even the spike is still ongoing.

So anyone here has similar experience? what is your method to deal with this
kind of problem?

adjusting the alpha value to a smaller value?

Any input is highly appreciated!

Joh
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.oetiker.ch/pipermail/rrd-users/attachments/20070523/0219091f/attachment.htm