[rrd-users] some questions about anomaly detection

[Rafal Gwizdala]

Hi guys, I need some help again:

1. I have a requirement to implement a deviation detection and forecasting
for business activity statistics I'm monitoring
--- Do you have an easy to follow tutorial on using rrdtool's
hwpredict/failure detection functions?
--- My data has two seasonal frequencies - one is daily (24h) pattern and
another one weekly (with much less activity on weekends). Is it possible to
have two seasonal periods in rrd (i mean with the SEASONAL consolidation),
or maybe a week cycle will be good for both?
--- is it possible to do some automatic forecasting for future days/months
using rrdtool alone?
--- how does failure detection work - is failure registered when the actual
value exceeds predicted value +/- predicted deviation?
--- if you have many data series in the rrd, does hwpredict work for all of
them, with same parameters?
--- my data will be aggregated hourly, daily, weekly or monthly. How do
predicted values and deviations behave when aggregating? What is the
behavior of predicted deviations - will they be smaller when aggregating
more samples (usually this is expected that large number of samples gives a
better approximation of the expected value)?

2. Supposing I finally manage to understand how to use hwpredicts, I will
need to implement automatic failure detection and triggering of some kind
of alerts.
Ideally, an alert should be triggered on updating the rrd with a sample of
data. There's some info in the docs that updatev option can be used for
outputting a detailed information about current data values, but if I have
the hwpredict RRAs, will it output failure information? (I know, it would
be easier to check it myself, but currently I don't have any rrds with
proper failure detection).

3. I'm using rrdupdate.exe program for updating my rrds (running in
Windows). Can it be configured for verbose output (updatev), or do I have
to use 'rrdtool.exe updatev'?

Thanks
RG
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.oetiker.ch/pipermail/rrd-users/attachments/20120705/4c497b12/attachment.htm