[rrd-users] False positives with aberrant behavior detection

[Dave Plonka]

On Mon, Aug 16, 2010 at 09:17:02AM -0700, Mike Schilli wrote:
> On Mon, 16 Aug 2010, Dave Plonka wrote:
> 
> > This would be easier for you to understand (why it's doing what it
> > does) if you plot the confidence band - i.e., the line above and below
> > the hwpreduct value that the observations must exceed to be considered
> > a violation.
> 
> I feel stupid for asking this, but how do I define the confidence band
> and how do I get rrdgraph to print it? The rrdcreate page mentions the
> confidence band several times but besides "defining a matching set of
> several RRDs" I can't find instructions in there on how to set my
> confidence band to a certain width.  It also references rrdgraph where
> supposedly there is an example of a printed confidence band, but
> searching for "confidence" on the rrdgraph page doesn't yield any
> results.

There is an example (listing 1, on the page numbered 144 in the PDF)
of Brutlag's paper:

   http://www.usenix.org/events/lisa00/brutlag.html
 
i.e., like the upper and lower CDEF in that example.
(You don't need the scaling b/c that just converts bytes to bits.)

Dave

-- 
plonka at cs.wisc.edu  http://net.doit.wisc.edu/~plonka/  Madison, WI