User:Andy/Fixing spikes in my Cacti graphs

From Strugglers
Jump to: navigation, search
Typical example of a graph ruined by a fake spike

How to fix graphs that are ruined by a fake spike.

Find the path to the RRD

Cacti can tell you by clicking the spanner icon. In this case it's /usr/share/cacti/site/rra/curacao_strugglers_net_traffic_in_33.rrd.

Have a look what values were seen in the interesting time span

Given the above graph, let's look at values between 22:00 and 23:00 UTC: 

$ date -d 22:00 +'%s'
1152568800
$ date -d 23:00 +'%s'
1152572400
$ sudo rrdtool dump \
/usr/share/cacti/site/rra/curacao_strugglers_net_traffic_in_33.rrd \
|./spikeinfo.pl 1152568800 1152572400
Mon Jul 10 22:00:00 2006 -> 2798.18 7812.31
Mon Jul 10 22:05:00 2006 -> 2675.90 6997.86
Mon Jul 10 22:10:00 2006 -> 6806795.16 6519037.20
Mon Jul 10 22:15:00 2006 -> 6806795.16 6519037.20
Mon Jul 10 22:20:00 2006 -> 78896.56 84694.42
Mon Jul 10 22:25:00 2006 -> 2573.26 3832.66
Mon Jul 10 22:30:00 2006 -> 2743.92 4098.37
Mon Jul 10 22:35:00 2006 -> 2697.84 7514.75
Mon Jul 10 22:40:00 2006 -> 2156.05 3592.04
Mon Jul 10 22:45:00 2006 -> 157440.33 9167.97
Mon Jul 10 22:50:00 2006 -> 3939.46 2789.31
Mon Jul 10 22:55:00 2006 -> 1707.92 3449.31
Mon Jul 10 23:00:00 2006 -> 1756.43 3063.50
Mon Jul 10 22:00:00 2006 -> 2603.09 6691.87
Mon Jul 10 22:30:00 2006 -> 2283413.33 2189616.28
Mon Jul 10 23:00:00 2006 -> 28283.01 4929.48
Mon Jul 10 22:00:00 2006 -> 3115.21 8752.33
Mon Jul 10 22:00:00 2006 -> 3384.46 10761.47
Mon Jul 10 22:30:00 2006 -> 6806795.16 6519037.20
Mon Jul 10 23:00:00 2006 -> 157440.33 9167.97
Mon Jul 10 22:00:00 2006 -> 3980.22 41898.09

The above values are in bytes/second. The spike of 6519037.2 bytes/sec at 22:10 / 22:15 UTC is what we would like to eradicate. The other spike at 22:30 is in the "weekly" graph for 2189616.28 bytes/sec and also needs to be removed.

Remove the erroneous values

The below command removes every value above 2000000 byes/sec between 22:00 and 23:00: 

$ sudo ./spikefix.pl \
/usr/share/cacti/site/rra/curacao_strugglers_net_traffic_in_33.rrd \
1152568800 1152572400 2000000
Processing /usr/share/cacti/site/rra/curacao_strugglers_net_traffic_in_33.rrd
between Mon Jul 10 22:00:00 2006 and Mon Jul 10 23:00:00 2006...
        Nuking value of 54454 kilobit/s at Mon Jul 10 22:10:00 2006 in first ds
        Nuking value of 52152 kilobit/s at Mon Jul 10 22:10:00 2006 in second ds
        Nuking value of 54454 kilobit/s at Mon Jul 10 22:15:00 2006 in first ds
        Nuking value of 52152 kilobit/s at Mon Jul 10 22:15:00 2006 in second ds
        Nuking value of 54454 kilobit/s at Mon Jul 10 22:30:00 2006 in first ds
        Nuking value of 52152 kilobit/s at Mon Jul 10 22:30:00 2006 in second ds
        Nuking value of 18267 kilobit/s at Mon Jul 10 22:30:00 2006 in first ds
        Nuking value of 17516 kilobit/s at Mon Jul 10 22:30:00 2006 in second ds
Done with /usr/share/cacti/site/rra/curacao_strugglers_net_traffic_in_33.rrd

Done

A graph "fixed" by spikefix.pl

The graph is now "fixed".

The fixing leaves a gap, but since the data was erroneous anyway then there's not much else that could be done. At least the other information on the graph can now be viewed.

Retrieved from "https://strugglers.net/w/index.php?title=User:Andy/Fixing_spikes_in_my_Cacti_graphs&oldid=1649"