[sdnog] cacti and old data values

[Nishal Goburdhan]

On 8 May 2016, at 9:44, Samir S. Omer wrote:

> Hi all
>
> can someone explain to me how does cacti/rrds work exactly in term of 
> storing values ?
> I noticed that the values get inaccurate when time is defined for old 
> times
>
> for example when I show the graph for last two days it shows a spike 
> in traffic. However, if I set the time for the last week I see the 
> graph is gone and graph is normal.


cacti uses rrdtool as a base;  so, yes, after a while, the law of 
averages means that you’ll lose granular reporting.
are you asking about the algorithms used for calculating these 
“averages”?
i’ve never really dug that deep into it, but you can probably find 
more information here:  http://oss.oetiker.ch/rrdtool/

you might also find that your cacti installation has additional plugins 
to remove traffic spikes.
from one of doc pages:  
http://oss.oetiker.ch/rrdtool/pub/contrib/spikekill-1.1-1.txt
“The spike killing methodologies supported in this utility are as 
follows:

   - Remove via Standard Deviation
   - Remove via Variance from Average

The Standard Deviation method first calculates the average of all Data 
Sources and
RRA's and determines the Standard Deviation of each combination.  It 
will then
remove any sample over X Standard Deviations from the Average.  The 
utility has the
option of replacing the spike by the average, or by a NaN at your 
discretion.

The Variance Method first calculates the average of all Data Sources and 
RRA's.
Before doing that it removes the top X and bottom X samples from each 
sample set
treating them as outliers.  Then, based upon the revised average will 
remove
all spikes Y percent above or below the revised averages.  Again, like 
the
Standard Deviation method, you have the option of replacing the spike 
with the
revised average or a NaN.”


hth,
—n.