[rrd-users] Getting Total Bytes from COUNTER Data Source

[Chris Mason]

Hi Ryan,

Thanks for that very clear explanation. I suppose 24 hours is a long
time with a wide variation in the peaks and troffs.
As you say I am going to experience an over estimation every time I
miss troff data or an under estimation if I miss the peaks.

Using the TOTAL function across a period that uses a 24 hr
consolidation function isn't that useful anyway so I will drop it off
my graphs.

Regards,
Chris

On 29 December 2011 05:00, Ryan Kubica <kubicaryan at yahoo.com> wrote:
>
> A RRA (aside from the initial step RRA) is a consolidation function.  You've
> created your RRD with some consolidation period (24 hour) and an xff which
> is a factor of pdp's (step datapoints) that will be used to 'create' the
> average (or total) in the RRA.
>
> So ... if you have set xff to .5 then half of your datapoints used to create
> the RRA can be missing and rrdtool will 'pretend' the rest would have been
> there -- based on your xff value.
>
> for a 5 minute RRA and total based on 1 minute data and an xff of .5:
>
> 1 min values: 3 3 4 5 6 = 4.2 = total 1,260
> 1 min and null: 3 3 null 5 6 = 4.25 ((3+3+5+6)/4) = total 1,275
> 1 min and 2 nulls: 3 3 null null 6 = 4 ((3+3+6)/3) = total 1,200
>
> now the fun part:
>
> 1 min and null
> from a low datapoint: null null 4 5 6 = 5 = total 1,500
>
>
> Based on the above example, you can see that any data missing in your
> 'troff' (low traffic part of the day) will skew your daily Total high - but
> ONLY for your 24 RRA ... because you're 24 hour RRA is doing this xff and
> then the Total function is operating off of the value and multiplying back
> out throughout the day.  It's doing exactly what you told it to do.
>
> The real solution is to not use a 24 hour RRA, ignore the first 24hour set
> of data, or never miss data. :-)  I'd side on the don't use 24 hour RRA's;
> they are a waste in many ways and obviously have inherent calculation error
> in them when they don't have all data available.
>
> -Ryan