[rrd-users] Incorrect MAX total from consolidated cacti graph

[Steve Shipway]

> I have a cacti graph which is a consolidation of 34 graphs of online user
counts.
> A primary purpose of this graph is to identify peaks in user counts.
> My problem is that the SUM of the MAX values is incorrect unless I
constrain
> the timeline of the graph to the minute containing the peak. I have
manually
> calculated the MAX values from the RRD files and know that the total of a
> recent peak is 242,409. Below is a screen capture of the one-minute sample
> in the graph which shows a matching total.

I can't tell for certain without having the actual RRDTool commandline used
to generate these graphs and the structure of the underlying RRD files, but
it is probably because of one of these things --

1. MAX( a+b )  <= MAX( a ) + MAX( b )
2. MAX( a ) >= MAX( AVG ( a ) )

The first can occur if you are adding the components before they are stored
into the RRD.  This is probably not the case here as you state that the
result is correct at small granularity (1min interval) but low at large
granularity (5min).

The second is more likely, and is caused when the wrong RRA is used to
generate the graph.  If your RRD files do not contain a MAX CF RRA, then
this is approximated by RRDTool at graph creation time using the available
data.  When you zoom out, RRDTool will move from using the 1pdp-AVG RRA to
using the 5pdp-AVG RRA, and so you will actually be graphing the maximum
5min average rather than the maximum sample.  The same problem hit me a long
time back with Routers2, and the solution was to explicitly use the MAX CF
RRA in the RRDTool commandline -- RRD1.4 also allows you to enforce the
'reduce' method to be MAX and enforce the granularity where necessary to
avoid this problem.  Calculations like 95th Percentile are particularly
prone to this.

Unfortunately, your RRD file and the commandline are being generated
internally by Cacti, so it is possible that it is not requesting MAX values
correctly - or even that there are no MAX RRAs available in the RRD file
itself.

I would suggest that you use 'rrdtool info' to verify that you have MAX CF
RRAs at the appropriate sizes and if not, create them.

Steve


Steve Shipway
T: +64 9 3737 599 ext 86487
E: s.shipway at auckland.ac.nz

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 5334 bytes
Desc: not available
URL: <http://lists.oetiker.ch/pipermail/rrd-users/attachments/20151028/75fa4c94/attachment.bin>