[rrd-users] Graphing inconsistencies graphing different time slices

[Steve Shipway]

(I just noticed that Simon Hobson has already said pretty much the same
thing (including an example!) already in a separate post.  However I'll
leave this response on the list just in case it can help give any additional
clarification)

> I have an inconsistency when I graph the same event over 10days versus
> 48hrs.  I would expect because I am using MAX that the peak on the 48hr
> graph and the 10day graph for the *same* event would still read the same
> number.  However, the peak for Sunday noon on the 48hr graph is at 600,
> and the peak for that same period on the 10day graph is *higher* at 1.1k.
I
> believe I have included all the necessary files below.  I didn't want to
paste
> the raw info here as it would be very large.  Any insight would be
appreciated.

This is because the max of the sum is not the same as the sum of the max for
two series.

max( a + b ) != max( a ) + max( b ) 

Your problem is that, in the two graphs, you are likely using different RRAs
which have been consolidated BEFORE you do your addition-and-max
calculations, resulting in different outcomes.

Here is an example.

Series 1 (highest-granularity RRA):
 1  2  3  4  5  6 
Series 2 (highest-granularity RRA):
12 11 10  9  8  7

Now, working on the highest granularity,  we add the series and get:
13 13 13 13 13 13

Take the max of this == 13.

However, if we have a lower-granularity RRA that consolidates 2 data points
using MAX, the series will become:
Series 1 (low-granularity RRA):
 2  4  6
Series 2 (low-granularity RRA):
12 10 8

Then, adding the value together gives:
14 14 14

Take the max of this series and you get 14 -- the higher-granularity RRA
results in a lower value.

How to avoid this --

The only ways are to do the calculation before there is any consolidation at
all in every case.  Try one of these options:
1. Create a separate RRD file that stores the sum of the values, and write
to this every interval as you update the other RRD files.  Then report on
this for the total line.  This is the easiest for rrdgraph, but it may be
difficult if your updates for the components come in at different times.
2. Extend the highest-granularity RRA to cover all 10 days (or more).  Then,
in your rrdgraph command, force the use of this higher-granularity RRA, even
though it would default to the lower-granularity one.  This means a lot more
consolidation done on the fly, but it gets done after the calculation.  This
is probably OK for a 10dy graph, but I wouldn't want to do it on a 10yr
graph.

Steve

Steve Shipway
s.shipway at auckland.ac.nz

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 10311 bytes
Desc: not available
URL: <http://lists.oetiker.ch/pipermail/rrd-users/attachments/20150608/2b722d80/attachment-0001.bin>