[rrd-users] Question with 1-hour samples

[Simon Hobson]

Jason wrote:

>This is my update command, which runs every 5 minutes from a perl script
>via Linux cron:
>RRDS::update("alerts.rrd", "N:$val");

First off, note that using N for the timestamp will, except under 
very specific (and hard to achieve) conditions result in 
normalisation of the data - I assume you've been reading Alex's 
tutorials(http://www.vandenbogaerdt.nl/rrdtool/), the one on 
normalisation is very important. So even if you did :
update foo1.rrd N:value
update foo2.rrd N:value
then foo1 and foo2 will not contain the same data because N has 
changed between the two calls.


>With the two following 1 Hour RRAs for the DS (only posting relevant
>data), this is how the RRDTool create creates the RRD:
>DS:alerts:COUNTER:600:U:U
>RRA:AVERAGE:0.5:12:336
>RRA:AVERAGE:0.5:12:1440
>
>Is my thinking correct here that this will take a 1 hour average of 12
>5-minute samples.  So each Consolidated Data Point is 1 hour.  The first
>RRA will be stored 336 rows/hours (14 Days), and the second RRA will be
>stored for 1440 rows/hours (60 days)?

Err, 600s is 10 minutes, not 5. Apart from that, then yes.

>Now let's say my data updates after the first 3 hours of the following CDPs:
>(20, 40, 30)

You mean, you've been updating for <some time> and you do something like :
update 03:00 20
update 03:05 40
update 03:10 30
?

>Wouldn't this mean that the MAX Consolidation Function will return 40 as
>the Maximum average for that 1 hour, for both 14 days of store, or 60
>days of storage?

It would (assuming later samples aren't larger), but in the above 
example you've used AVERAGE


>   This is what I'm assuming, but maybe I am wrong.
>
>This is what the graphing function is doing:
>
>DEF:myaverage=/alerts.rrd:alerts:AVERAGE
>CDEF:alerthouravg=myaverage,3600,*
>GPRINT:alerthouravg:MAX:Maximum alerts per hour\\:  %6.2lf
>AREA:alerthouravg#1E90FF:Average per Hour
>
>When the data graphs, it shows what I wouldn't expect.  For the 60 days
>of storage graph, the Maximum average shows up as a lower value (20),
>and the 14 days of storage graph shows a higher value (40).  This makes
>no sense to me.  Am I correct in my assumption that for the sample
>stored data above, they should both graph / gprint that the Max 1-hour
>average is 40?

Again, I only see AVERAGE there, no hint of MAXIMUM. Max of average 
is NOT the same as max of max. If you have the three values above 
(20,40,30) and they 'filled' a consolidated data point, the average 
over the period would be 30 and the max would be 40. If in the 
graph/fetch you then max of an average consolidation will be 30, max 
of a maximum consolidation would be 40.

>In my real data:
>The 14 Day graph shows / prints the Maximum alerts per hour of 122,729
>while the 60 day graph shows / print the Maximum alerts per hour of
>49,610.
>
>I will fetch out the real data ...

You really need to script some sample data. It only need by fairly 
simple, and preferably not silly large values that are hard to work 
with in your head. By using known (and repeatable) inputs, you can 
easily compare what you get with what you put in.

It may be that by creating the test data you will realise what the 
problem is - if not then it should make it easier to diagnose.
-- 
Simon Hobson

Visit http://www.magpiesnestpublishing.co.uk/ for books by acclaimed
author Gladys Hobson. Novels - poetry - short stories - ideal as
Christmas stocking fillers. Some available as e-books.