[rrd-users] Obtain MAX value and time from an RRD

[Eric Schoeller]

I've found a few threads of conversation on how to fetch a single MAX 
value (along with the date/time) from an entire set of RRD data. Here is 
what I ended up with:

$ rrdtool graph /dev/null 
'DEF:A=systemtotalpower_9804.rrd:systemTotalPower:MAX' 
'VDEF:B=A,MAXIMUM' 'PRINT:B:"%c":strftime' 'PRINT:A:MAX:%.3lf'
0x0
"Sun Mar 25 17:24:00 2012"
6157.600

The time isn't always completely correct. After looking through the RRD 
data sometimes it's off by a few minutes, which I find confusing. Now 
this works just fine for the default --start of one day ago. I am trying 
to find the MAX over the entire lifespan of the RRD file. So, my 
approach is to determine the beginning of a particular RRA, let's assume 
index 0:

$ rrdtool first systemtotalpower_9804.rrd
702001800

(this is a *very* large RRA ... yes that equates to March 31, 1992 ... 
mostly for worst-case testing)

So, I transform the 'graph' directive to span the entire data set:

$ rrdtool graph /dev/null -s 702001800 -e NOW 
'DEF:A=systemtotalpower_9804.rrd:systemTotalPower:MAX' 
'VDEF:B=A,MAXIMUM' 'PRINT:B:"%c":strftime' 'PRINT:A:MAX:%.3lf'
0x0
"Wed Dec 31 17:00:00 1969"
nan

And this is where I run into trouble. I'm clearly not looking for a 
'nan' value. A *huge* portion of this RRA is filled with NaN's - and I 
would expect that since it's got a 20 year lifespan and I created it 
yesterday. Why is unknown data considered a MAX? I would expect rrdtool 
to consider everything *but* nan readings and compute a MAX from those 
values. Perhaps I need to use another function other than 'first' to 
determine where the real data is starting, and not just the first 
available data slot in the particular RRA. Or is this RRA just too big??

I am afraid the recommendation will be to simply run a 'fetch' across 
the whole RRA and do the calculations on my own. I am hoping that is not 
the case, I'd really like to leverage the functionality of rrdtool to 
accomplish this!

My end goal is to determine if the MAX value for a data source has been 
reached within the past N minutes.

Thanks,

Eric Schoeller
University of Colorado Boulder
Office of Information Technology