User:Andy/Fixing spikes in my Cacti graphs



How to fix graphs that are ruined by a fake spike.

Find the path to the RRD
Cacti can tell you by clicking the spanner icon. In this case it's /usr/share/cacti/site/rra/curacao_strugglers_net_traffic_in_33.rrd.

Have a look what values were seen in the interesting time span
Given the above graph, let's look at values between 22:00 and 23:00 UTC:

$ date -d 22:00 +'%s' 1152568800 $ date -d 23:00 +'%s' 1152572400 $ sudo rrdtool dump \ /usr/share/cacti/site/rra/curacao_strugglers_net_traffic_in_33.rrd \ Mon Jul 10 22:00:00 2006 -> 2798.18 7812.31 Mon Jul 10 22:05:00 2006 -> 2675.90 6997.86 Mon Jul 10 22:10:00 2006 -> 6806795.16 6519037.20 Mon Jul 10 22:15:00 2006 -> 6806795.16 6519037.20 Mon Jul 10 22:20:00 2006 -> 78896.56 84694.42 Mon Jul 10 22:25:00 2006 -> 2573.26 3832.66 Mon Jul 10 22:30:00 2006 -> 2743.92 4098.37 Mon Jul 10 22:35:00 2006 -> 2697.84 7514.75 Mon Jul 10 22:40:00 2006 -> 2156.05 3592.04 Mon Jul 10 22:45:00 2006 -> 157440.33 9167.97 Mon Jul 10 22:50:00 2006 -> 3939.46 2789.31 Mon Jul 10 22:55:00 2006 -> 1707.92 3449.31 Mon Jul 10 23:00:00 2006 -> 1756.43 3063.50 Mon Jul 10 22:00:00 2006 -> 2603.09 6691.87 Mon Jul 10 22:30:00 2006 -> 2283413.33 2189616.28 Mon Jul 10 23:00:00 2006 -> 28283.01 4929.48 Mon Jul 10 22:00:00 2006 -> 3115.21 8752.33 Mon Jul 10 22:00:00 2006 -> 3384.46 10761.47 Mon Jul 10 22:30:00 2006 -> 6806795.16 6519037.20 Mon Jul 10 23:00:00 2006 -> 157440.33 9167.97 Mon Jul 10 22:00:00 2006 -> 3980.22 41898.09
 * ./spikeinfo.pl 1152568800 1152572400

The above values are in bytes/second. The spike of 6519037.2 bytes/sec at 22:10 / 22:15 UTC is what we would like to eradicate. The other spike at 22:30 is in the "weekly" graph for 2189616.28 bytes/sec and also needs to be removed.

Remove the erroneous values
The below command removes every value above 2000000 byes/sec between 22:00 and 23:00:

$ sudo ./spikefix.pl \ /usr/share/cacti/site/rra/curacao_strugglers_net_traffic_in_33.rrd \ 1152568800 1152572400 2000000 Processing /usr/share/cacti/site/rra/curacao_strugglers_net_traffic_in_33.rrd between Mon Jul 10 22:00:00 2006 and Mon Jul 10 23:00:00 2006... Nuking value of 54454 kilobit/s at Mon Jul 10 22:10:00 2006 in first ds       Nuking value of 52152 kilobit/s at Mon Jul 10 22:10:00 2006 in second ds        Nuking value of 54454 kilobit/s at Mon Jul 10 22:15:00 2006 in first ds        Nuking value of 52152 kilobit/s at Mon Jul 10 22:15:00 2006 in second ds        Nuking value of 54454 kilobit/s at Mon Jul 10 22:30:00 2006 in first ds        Nuking value of 52152 kilobit/s at Mon Jul 10 22:30:00 2006 in second ds        Nuking value of 18267 kilobit/s at Mon Jul 10 22:30:00 2006 in first ds        Nuking value of 17516 kilobit/s at Mon Jul 10 22:30:00 2006 in second ds Done with /usr/share/cacti/site/rra/curacao_strugglers_net_traffic_in_33.rrd

Done


The graph is now "fixed".

The fixing leaves a gap, but since the data was erroneous anyway then there's not much else that could be done. At least the other information on the graph can now be viewed.