Averaged data graphs not displaying peaks over time

[ben_c]

Hi guys,

I'm trying to solve why my data graphs are not displaying peaks over time, ie : see attachments.

The peaks for the 1 day for example will be 34Mbit, but the graph only shows a peak of 2Mbit.

Is this due to the roundrobin archives? Mine are the default and look like :

Hourly (1 Minute Average) 1 500 14400
Daily (5 Minute Average) 1 600 86400
Weekly (30 Minute Average) 6 700 604800
Monthly (2 Hour Average) 24 775 2678400
Yearly (1 Day Average) 288 797 33053184

If I change these, will it display the peaks? Is there a way I can fix this for existing graphs without having to recreate them with a new template??

Any help appreciated!

[gandalf]

You're seeing an effect of rrdtool consolidation for AVERAGE consolidation function. You will want to use the MAXIMUM consolidation function to see the maximum traffic reached.
Find some hints at the 1st link of my sig, see RRDTool Chapter
Reinhard

[ben_c]

Ok, so to display the max peaks in these existing graphs, do I just need to de-select 'AVERAGE' from the round robin archive and simply leave MAX? Will this damage any existing graphs or simply fix them?

[TheWitness]

It would appear that your RRA template does not include the MAX and MIN values in the RRDfiles. As a result, you will not be able to see the peaks. You would also have to add that graph item to the Graph Template.

That way, you could essentially create the default MRTG look and feel. However, you old RRDfiles are pretty much useless.

TheWitness

[ben_c]

Gah :/

- Ben

[ben_c]

Guys, i'm still a little unclear on this. I have a a yearly graph that only displays a 10MB peak, yet it's MAX says 80MB, but even when I drill down, I never see that peak.

How can I 'fix' that? MAX is selected in all my RRA's and i'm using the default Cacti Interface template, what needs to be changed in order to display the peaks?

And can rrdtool tune be used at all to remedy this?

[gandalf]

Guys, i'm still a little unclear on this. I have a a yearly graph that only displays a 10MB peak, yet it's MAX says 80MB, but even when I drill down, I never see that peak.

How can I 'fix' that? MAX is selected in all my RRA's and i'm using the default Cacti Interface template, what needs to be changed in order to display the peaks?

And can rrdtool tune be used at all to remedy this?

In fact, I was sort of waiting for such a question to arise.
But to verify my personal assumption, I first need the whole rrdtool graph statement. Visit Graph management, select the graph and switch to debug. Post output, please. It is not required to see the requested peak in that graph (it will only display last day timespan).
I'm quite sure, that the issue is related to the fact, that MAX is related to the CF=MAX whereas the graph area/line usually are related to CF=AVERAGE.
Reinhard

[ben_c]

Hehe, hi gandalf, thanks.

Here's the rrdtool statement. Atatched is also an example graph. Even if I drill down to the peaks, I never see the high maximum that are printed in the graph, I need to try fix this, otherwise the historical data is next to useless.

RRDTool Command:

/usr/local/rrdtool/bin/rrdtool graph - \
--imgformat=PNG \
--start=-86400 \
--end=-300 \
--title=" su-rtr-21 - Traffic - Gi0/1 - IPMAN Primary Port xxxxxxx" \
--rigid \
--base=1000 \
--height=120 \
--width=500 \
--alt-autoscale-max \
--lower-limit=0 \
--vertical-label="bits per second" \
--slope-mode \
--font TITLE:10: \
--font AXIS:8: \
--font LEGEND:8: \
--font UNIT:8: \
DEF:a="/usr/local/cacti/rra/su-rtr-21_traffic_in_25039.rrd":traffic_in:AVERAGE \
DEF:b="/usr/local/cacti/rra/su-rtr-21_traffic_in_25039.rrd":traffic_in:MAX \
DEF:c="/usr/local/cacti/rra/su-rtr-21_traffic_in_25039.rrd":traffic_out:AVERAGE \
DEF:d="/usr/local/cacti/rra/su-rtr-21_traffic_in_25039.rrd":traffic_out:MAX \
CDEF:cdefa=a,8,* \
CDEF:cdefd=b,8,* \
CDEF:cdefe=c,8,* \
CDEF:cdefh=d,8,* \
AREA:cdefa#00CF00FF:"Inbound" \
GPRINT:cdefa:LAST:" Current\:%8.2lf%s" \
GPRINT:cdefa:AVERAGE:"Average\:%8.2lf%s" \
GPRINT:cdefd:MAX:"Maximum\:%8.2lf%s\n" \
LINE1:cdefe#002A97FF:"Outbound" \
GPRINT:cdefe:LAST:"Current\:%8.2lf%s" \
GPRINT:cdefe:AVERAGE:"Average\:%8.2lf%s" \
GPRINT:cdefh:MAX:"Maximum\:%8.2lf%s"

RRDTool Says:

OK

Thanks for your help

[gandalf]

Yep, I suppose my assumption was correct. Please run

Code: Select all

/usr/local/rrdtool/bin/rrdtool graph /tmp/img.png \
--imgformat=PNG \
--start=-86400 \
--end=-300 \
--title=" su-rtr-21 - Traffic - Gi0/1 - IPMAN Primary Port xxxxxxx" \
--rigid \
--base=1000 \
--height=120 \
--width=500 \
--alt-autoscale-max \
--lower-limit=0 \
--vertical-label="bits per second" \
--slope-mode \
--font TITLE:10: \
--font AXIS:8: \
--font LEGEND:8: \
--font UNIT:8: \
DEF:a="/usr/local/cacti/rra/su-rtr-21_traffic_in_25039.rrd":traffic_in:AVERAGE \
DEF:c="/usr/local/cacti/rra/su-rtr-21_traffic_in_25039.rrd":traffic_out:AVERAGE \
CDEF:cdefa=a,8,* \ 
CDEF:cdefe=c,8,* \
AREA:cdefa#00CF00FF:"Inbound" \
GPRINT:cdefa:LAST:" Current\:%8.2lf%s" \
GPRINT:cdefa:AVERAGE:"Average\:%8.2lf%s" \
GPRINT:cdefa:MAX:"Maximum\:%8.2lf%s\n" \
LINE1:cdefe#002A97FF:"Outbound" \
GPRINT:cdefe:LAST:"Current\:%8.2lf%s" \
GPRINT:cdefe:AVERAGE:"Average\:%8.2lf%s" \
GPRINT:cdefe:MAX:"Maximum\:%8.2lf%s" 

from command line and post resulting image /tmp/img.png
Reinhard

[ben_c]

Attached.

[ben_c]

FYI that's how the Daily (5 Minute Average) graph currently looks in Cacti, but it's when you get to the weekly/monthly/yearly that the peaks completely mismatch with the 'max' values.

[gandalf]

Attached.

That matches, doesn't it?
Reinhard

[gandalf]

FYI that's how the Daily (5 Minute Average) graph currently looks in Cacti, but it's when you get to the weekly/monthly/yearly that the peaks completely mismatch with the 'max' values.

Sure, because on first consolidation level, ALL CFs show identical values (that is: no consolidation takes place). That's why in most cases, this "bug" is not identified as such
Reinhard

[ben_c]

Attached.

That matches, doesn't it?
Reinhard

It matches the actual data? Yes.

So is there a fix for this? My weekly/monthly/yearly graphs don't seem to represent the true historical data they should and therefore are close to useless right now

[gandalf]

Will have to discuss with the other devs
Reinhard