Are all Cacti graphs "wrong" by default?

[vosjames]

Hi all,

I'm sure many of you use Cacti to monitoring network traffic (server/router/switch/firewall interface speeds). I have a problem with Cacti which I assume everyone has?

When you enable debugging for a graph to see the RRD command used to generate that graph you will see something like;

Code: Select all

DEF:a='/var/lib/cacti/rra/router1_traffic_in_11666.rrd':'traffic_in':AVERAGE
DEF:b='/var/lib/cacti/rra/router1_traffic_in_11666.rrd':'traffic_out':AVERAGE

Please can someone correct me if I am wrong but AVERAGE is not what is wanted here though (for my situation). Like many Cacti users, you are might be an ISP that bill's based on the data stored in RRDs or you are billed by your ISP and monitor your usage by storring it in RRDs using Cacti. In order to be able to look at customer usage for say the past six months the first step is to change the RRDs being used, so I have some different data templates that creates RRDs that don't summerise and average, keeping full data accuracy for 2 years;

Code: Select all

me@server:~$ sudo rrdtool info /var/lib/cacti/rra/router1_traffic_in_11666.rrd
filename = "/var/lib/cacti/rra/router1_traffic_in_11666.rrd"
rrd_version = "0003"
step = 300
last_update = 1386606906
ds[traffic_in].type = "COUNTER"
ds[traffic_in].minimal_heartbeat = 600
ds[traffic_in].min = 0.0000000000e+00
ds[traffic_in].max = 1.0000000000e+09
ds[traffic_in].last_ds = "1601976753"
ds[traffic_in].value = 1.6551294400e+06
ds[traffic_in].unknown_sec = 0
ds[traffic_out].type = "COUNTER"
ds[traffic_out].minimal_heartbeat = 600
ds[traffic_out].min = 0.0000000000e+00
ds[traffic_out].max = 1.0000000000e+08
ds[traffic_out].last_ds = "72738702"
ds[traffic_out].value = 1.5563000000e+04
ds[traffic_out].unknown_sec = 0
rra[0].cf = "AVERAGE"
rra[0].rows = 230400
rra[0].pdp_per_row = 1
rra[0].xff = 5.0000000000e-01
rra[0].cdp_prep[0].value = NaN
rra[0].cdp_prep[0].unknown_datapoints = 0
rra[0].cdp_prep[1].value = NaN
rra[0].cdp_prep[1].unknown_datapoints = 0
rra[1].cf = "MAX"
rra[1].rows = 230400
rra[1].pdp_per_row = 1
rra[1].xff = 5.0000000000e-01
rra[1].cdp_prep[0].value = NaN
rra[1].cdp_prep[0].unknown_datapoints = 0
rra[1].cdp_prep[1].value = NaN
rra[1].cdp_prep[1].unknown_datapoints = 0

The problem I am having now though is that the graphs aren't quite "right" (I mean accurate) when Cacti draws them and I think the problem is the graph templates.

Cacti's Graph:


My Graph:


As you can see my graphs have a higher value for both the Average upload & download and the Maximum upload & download values. The difference is though, is that my graph was generated with the following (MAX instead of AVERAGE data source);

Code: Select all

DEF:in="/var/lib/cacti/rra/router1_traffic_in_11666.rrd":traffic_in:MAX
DEF:out="/var/lib/cacti/rra/router1_traffic_in_11666.rrd":traffic_out:MAX

If I run the same RRD command I used to generate my first graph but use AVERAGE instead of MAX I get a graph the same as Cacti produces in the web interface naturally;


The default set up of Cacti here is displaying less data that I am actually using, but it that correct value is being stored in my RRD because I have created my custom data source templates. What I need to do (I believe) is change my graph templates on Cacti to use MAX instead of AVERAGE. Here is a picture of the graph template used by Cacti to generate the first of the three graphs shown above, which is what Cacti generates by default;




I have a copy of this template which I am using with my custom data source template, which is as follows;

• If I change the CF on Item 1, Item 5, Item 10 and Item 11 to MAX from AVERAGE will I get the result I get from my custom RRD command? This is a live production system so I don't want to mess all the graphs up
• If the above is correct, if I change this graph template, will it update all graphs that are already using this template (since I have thousands, so I don't have to update them all) ?
• What negative effects may come from changing all these to use MAX? I'm trying to improve data accuracy over time here for historical billing purposes and reviewing, server storage isn't really a problemy here.

[paulgevers]

If I understood correctly, you want to read up on RRD consolidation. If you consolidate multiple timestamps with MAX, you get of course the maximum of the consolidated time. Most of the time (e.g. for you billing) you want the mean of that time, which is what you get with AVERAGE.

Of course, if you keep all the data, the answer should be exactly the same.

(But maybe *I* am wrong here).

[vosjames]

Thanks for the response paulgevers,

I don't think consolidation is the problem here. I am keeping data for 2 years and getting data from within the last few months, unless I have misunderstoond something? If so, can you explain?

Presumably when Cacti pulls data from an SNMP host the value pulled goes into the MAXIMUM rra, exactly as it is pulled form the SNMP host, so this is the most accurate rra inside the RRD file? Is that correct?

[vosjames]

OK this mystery has been solved on the Cacti mailing list, the thread is here; http://oss.oetiker.ch/rrdtool/forum.en. ... -td7581547

I am experiancing consolidation at the point of drawing the data onto the graph, this is a 2nd stage of consolidation as well as RRD storage consolidation.