[rrd-users] False positives with aberrant behavior detection

[Mike Schilli]

Hi rrdtool folks,

I'm trying to get aberrant behavior detection to work with rrdtool
1.3.8, but can't find a combination of alpha, beta, and gamma that gets
me proper detection without an unacceptable number of false positives.

Here's the graph I got so far:

     http://perlmeister.com/tmp/rrdhelp.jpg

The data is from a temperature sensor, which has a resolution of .5
degrees Celsius. The data covers 7 days [1] and the rrdtool commands
I've used are available at [2]. For this example, I've used alpha=0.5,
beta=0.5, gamma=0.5, with a seasonal period of 60*24 (one day in
one-minute steps).

What I've noticed so far:

* The green line (rrdtool's prediction) is only available after the 3rd
   day. What's the reason for that?

* There's a clear jump in the middle of the graph which goes undetected.

* There's a high number of false positives, starting after the spike,
and continuing until the end of the graph. I've tried various
combinations of alpha, beta, and gamma to get rid of them but without
success.

Any idea on what I'm doing wrong here? Raw data and rrdtool commands are
available at the URLs listed below. Thanks for any help.

-- Mike

Mike Schilli
m at perlmeister.com

[1] http://perlmeister.com/tmp/rrdhelp.data 
[2] http://perlmeister.com/tmp/rrdhelp.debug