[rrd-users] Holt--Winters - learning phase / poisoning algorithm

[John P. Rouillard]

In message <1318447139088-6886392.post at n2.nabble.com>,
Crypty writes:
>if I run HW prediction algorithm, it's collecting data for a day at first.
>Since than, it's saving HW predicted values and after next day it presents
>failures... I understand that...
>
>During these two days it is important to have the network or whatever
>without any aberrant behaviours because it could learn these patterns
>badly... 
>
>What am I wondering is: If I am e.g. collecting data for a week and now a
>failure occurs, will it be counted into a HW prediction in the future? Or by
>tagging it as a failure it won't be counted in to the future prediction?
>It's about, that even if I have a network without a failures from the
>beginning, than a failure occurs, will HW prediction learn this and will it
>tag it as a failure next day again?
>
>Long story short - does the algorithm learns all the time so it could even
>learn bad patterns or are they automatically discarded as they are tagged as
>failures?

Well IIRC from some experiments I ran a few years ago the answer is it
depends.

The values you give for alpha, beta and gamma (for the intercept,
linear component and seasonal component) can cause the next prediction
to weigh the last update (whether it is aberrant or not) excessively
strongly effecively "learning" the aberant activity and changing the
prediction to accept the aberant case.

However it also works in reverse in that activity that returns to the
baseline is also weighed too high and results in reporting the
baseline as aberrant until the prediction is updated to the aberrant
case.

I no longer remember exactly how sensitive the prediction was to the
different values (alpha, beta, gamma) and how far from the default
rrdtool values I had to go to get a shift of the prediction that
included the aberrant data. I think the worst case that I tested for
some set of parameters was 10% of the data was able to produce the
shift.

So yes you can adjust to a new baseline but it should be over the span
of days of data not minutes of data.

If anybody else has any experimental or anecdotal evidence on this I
would love to hear about it.

--
				-- rouilj
John Rouillard
===========================================================================
My employers don't acknowledge my existence much less my opinions.