Holt-Winters functionality (forecasting) with Cacti

cwahlin · Post by **cwahlin** » Sat Mar 08, 2008 3:33 pm

I just realized I don't work with cacti often enough. Every time I find a new function I need/like I have to learn everything over again. Now I struggle with a graph template and RRAs (again!) to get it the way it needs to be.

/Carl

gilesc · Post by **gilesc** » Tue Mar 11, 2008 8:19 am

This example is just more data of the other RRA.

You can see the confidence bands are well trained for a 24 hour season, but they get confused at the weekend.

Hope to have another graph of a different datasource available tomorrow or the day after.

It should have prediction & confidence bands for both incoming and outgoing traffic.

gilesc · Post by **gilesc** » Tue Mar 11, 2008 9:37 am

Here's an example of alerting (not using Cacti thresholds, but Nagios). The Window Length is 9 and the failure threshold is 6. Delta pos and delta neg, I believe, are the number of standard deviations away from the predicted value to trigger an alert (same as our confidence bands), you can see the raw FAILURES data below.

Example Dump of RRA, showing failures:

<params>
<delta_pos> 2.0000000000e+00 </delta_pos>
<delta_neg> 2.0000000000e+00 </delta_neg>
<window_len> 9 </window_len>
<failure_threshold> 6 </failure_threshold>

...snip...

 <row><v> 0.0000000000e+00 </v><v> 0.0000000000e+00 </v></row>
 <row><v> 1.0000000000e+00 </v><v> 0.0000000000e+00 </v></row>
 <row><v> 1.0000000000e+00 </v><v> 0.0000000000e+00 </v></row>
 <row><v> 1.0000000000e+00 </v><v> 0.0000000000e+00 </v></row>
 <row><v> 1.0000000000e+00 </v><v> 0.0000000000e+00 </v></row>
 <row><v> 0.0000000000e+00 </v><v> 0.0000000000e+00 </v></row>

Here are the Email's from Nagios notifying about the abberant behaviour and the restoration of normal traffic:

Code: Select all

Notification Type: PROBLEM

Service: Cacti - Test Bandwidth
Host: Cacti
Address: 192.168.1.1
State: WARNING

Date/Time: Tue Mar 11 13:47:36 CET 2008

Additional Info:

WARNING Inbound - Current BW in: 16.71Mbps Out: 22.04Mbps

Email from Nagios giving resolution of problem:

Code: Select all

Notification Type: RECOVERY

Service: Cacti - Test Bandwidth
Host: Cacti
Address: 192.168.1.1
State: OK

Date/Time: Tue Mar 11 14:06:12 CET 2008

Additional Info:

OK - Current BW in: 15.05Mbps Out: 21.58Mbps

Hope this might be a little useful to some.

sveioen · Post by **sveioen** » Wed Mar 12, 2008 8:28 am

Awesome graph, gilesc. Thanks to you, I have resumed my experimentation with HW

. About the problem I wrote about in my previous post. If you look at wind_weekly.png and wind_weekly2.png (about 12 hours later), you see that the old data just disappears! Do you have any clue why this is?

gilesc · Post by **gilesc** » Wed Mar 12, 2008 8:51 am

sveioen wrote:Awesome graph, gilesc. Thanks to you, I have resumed my experimentation with HW . About the problem I wrote about in my previous post. If you look at wind_weekly.png and wind_weekly2.png (about 12 hours later), you see that the old data just disappears! Do you have any clue why this is?

That's interesting...

I can't say what causes it, but I reckon that the answer would be displayed somewhere in the XML in a "rrdtool dump file.rrd" command. Perhaps the data source has been truncated in size for some reason. Unfortunately I don't think the rrd_hwreapply perl script is perfect, and can have difficulties with some RRD files, it's also not really been developed on for a few years or so. I'm no perl, nor XML guru... but I'm hoping there's enough people watching this thread with enough interest to provide solutions to the problems.

As an aside, I reckon that there is real money to be made in a "catch all" rrd manipulation tool with a GUI interface... these kind of problems could be resolved real quickly.

Anyway, I'll take the opportunity to attach a screenshot of my latest graph, our data source behaviour was changed recently (just under a week ago) so the predictions and confidence bands are not ideal (yet) - the season is a 2016 weekly, but it's nice enough to post to the forum.

sveioen · Post by **sveioen** » Sat Mar 15, 2008 7:43 am

Ok, I have just found out what I have been doing wrong(

). For every update on the rrd-files (those with no HW), I have been using rrd_hwreapply and made HW-able-copies. So I have made a "new clean" HW-rrd every time with minimum HW-data. It never occured to me that this is a script you run only once to initiate the HW-stuff, and then update the new file the normal way.

At least its working now!

gilesc: Love the graph

sveioen · Post by **sveioen** » Mon Mar 17, 2008 7:59 am

Code: Select all

TICK:fail#ffffa0:1.0:"Feil\n" \

Added TICK

.

gilesc · Post by **gilesc** » Mon Mar 17, 2008 8:12 am

sveioen wrote:
Code: Select all
TICK:fail#ffffa0:1.0:"Feil\n" \
Added TICK .

OK - I want this

- is that within Cacti, or is it a graph custom made from the RRD....

sveioen · Post by **sveioen** » Mon Mar 17, 2008 11:35 am

gilesc wrote:
sveioen wrote:
Code: Select all
TICK:fail#ffffa0:1.0:"Feil\n" \
Added TICK .
OK - I want this - is that within Cacti, or is it a graph custom made from the RRD....

It is a graph custom made from the RRD. It's actually really simple to add the TICK-thing. Just add:

Code: Select all

DEF:fail="/blabla/bla/windhw.rrd":wind:FAILURES \
TICK:fail#ffffa0:1.0:"Feil\n" \

Ref.: http://www.usenix.org/events/lisa2000/f ... tlag_html/

Post by **gandalf** » Mon Mar 17, 2008 12:20 pm

TICK is not (yet) supported by cacti. But IF we will integrate HW, perhaps we'll add TICK as well. Not earlier than 088, for sure
Reinhard

gilesc · Post by **gilesc** » Wed Mar 26, 2008 5:16 am

Here's another iteration of the graph I showed before.

This is a Cacti RRD, but the RRA was generated with the TICK entry outside of Cacti. The same graph exists in the Cacti interface without the TICK entry.

Also - the weekly graph, which is looking pretty good now.

sveioen · Post by **sveioen** » Tue Apr 08, 2008 3:02 pm

Very nice. One thing though, in the lower graph gilesc, the real value is way off the lower confidence band, still no TICK is drawn?

And; I know I should know this, but exactly what can a HW-graph tell you? I know it is supposed to give a predicted value based on previous data (right?), but here we just have a predicted value and the real value graphed at the same time, so you cant really call it a forecast. Or I am missing something?

cwahlin · Post by **cwahlin** » Wed Apr 09, 2008 5:06 am

sveioen wrote:Very nice. One thing though, in the lower graph gilesc, the real value is way off the lower confidence band, still no TICK is drawn?

And; I know I should know this, but exactly what can a HW-graph tell you? I know it is supposed to give a predicted value based on previous data (right?), but here we just have a predicted value and the real value graphed at the same time, so you cant really call it a forecast. Or I am missing something?

It is a predicted value of what it should be based on previous values. And therefor when it is not within the predicted parameters, you might be having some weird stuff going on in your network that someone might want to look into

Not sure if it can be used to predict your bandwidth requirements next year

/Carl

sveioen · Post by **sveioen** » Fri Apr 11, 2008 3:49 am

cwahlin wrote:Not sure if it can be used to predict your bandwidth requirements next year

/Carl

Didn't think so

.

Howie · Post by **Howie** » Fri Apr 11, 2008 6:29 am

cwahlin wrote:It is a predicted value of what it should be based on previous values. And therefor when it is not within the predicted parameters, you might be having some weird stuff going on in your network that someone might want to look into

With that in mind, does rrdtool's implementation have any way to communicate with the outside world (e.g. PRINT) so that you could have some sort of alerting? What you *really* want is a report that shows links that are "a bit funny" so you can look at them. If you have to go and look at each graph to do that, well, you're looking at each graph so what's the point?

Cacti

Holt-Winters functionality (forecasting) with Cacti

Example

Nagios Integration

Who is online