[rrd-users] Fetch the time of the first entry

[Simon Hobson]

Steven Sim <unixandme at outlook.com> wrote:

> BUT when I use rrdtool first <rrd database> in an attempt to get the time of the first entry, I get a Unix time stamp which is one entire month EARLIER than the first entry in the file.
> 
> And each time I do update, rrdtool first <rrd_database> returns a DIFFERENT number.

With each update, does the FIRST value update to be one month (or 30 days) before the timestamp of the update ?

If so then I think I know what's happening. When you create teh RRD file, it is created in it's entirety - in your case with buckets for 2880 consolidated values. These exist regardless of what updates you do or do not do, and the timespan of them is determined by your step and consolidation values.
What I suspect is happening, and what I alluded to earlier, is that even though you haven't done any updates for those historical buckets, they are still there - and FIRST is merely reporting the timestamp of the oldest bucket. Since you are setting the start time of the RRD when you create it, then the timestamp of the oldest bucket will be 30 days prior to that. As you perform updates, you overwrite the oldest buckets and the value of FIRST will advance to be 30 days prior to the last update.

Internally to RRD, there is no storage for whether a bucket actually had any updates - only for it's value after applying the consolidation rules specified. Thus there is no way to know if the oldest bucket ever had an update if it's value is NaN - you don't know if it was created with NaN and has never been overwritten, or if it was updated but the calculated value was NaN. You would have to search back through the database to find the oldest bucket with an actual value and infer that this bucket was *probably* the one with the oldest data.