I've heard rumors that this will be coming in a future version of zenoss (but don't quote me on that).
However, I already have this working on my ZenOSS installation. If you can't wait and want to see aberrant behaviour working right now, you will need to define custom commands to create the graphs and custom commands to display the graphs. This is done within a template. So, as an example: in your template->data source->data point->Create cmd field add something like this:- Code: RRA:AVERAGE:0.3:1:8640 RRA:AVERAGE:0.3:3:17280 RRA:AVERAGE:0.3:12:17532 RRA:HWPREDICT:1440:0.1:0.0035:288 This will ensure that your RRD file is created with all the requirements to enable, Holt-Winter aberrant behaviour detection. The aberrant detection RRAs will be filled in automatically when the normal rrdupdate is run by ZenOSS. Note the custom create command will not run if the rrd file already exists, so either start with a new datasource or manually delete/rename the existing rrd file explanation:- RRA:AVERAGE:0.3:1:8640 <= standard cycle stored for 30days RRA:AVERAGE:0.3:3:17280 <= 3*standard cycle stored for 180 days RRA:AVERAGE:0.3:12:17532 <= 12*standard cycle stored for 2 years RRA:HWPREDICT:1440:0.1:0.0035:288 <= enable RRAs for aberrant detection, 1 day seasonal store for 5 days See the rrdcreate man page and http://cricket.sourceforge.net/aberrant/rrd_hw.htm for info on these commands To actually see the prediction lines and aberrant detection in your graphs you will need to add a custom graph definition in your template -> graph -> custom field. This is the tricky bit as you have to reference the data source in your custom command, so this will be different for each graph. Also, you will need to use different commands to graph more than one data source. Here is an example of what I use:- For a graph with a single data source use the following template (replace **ONE** with the exact name of your datasource e.g. ifHCInOctets_ifHCInOctets; replace **ONELABEL** with any label for the graph item being graphed) Code: DEF:pred=/opt/zenoss/perf${here/rrdPath}/**ONE**.rrd:ds0:HWPREDICT DEF:dev=/opt/zenoss/perf${here/rrdPath}/**ONE**.rrd:ds0:DEVPREDICT DEF:fail=/opt/zenoss/perf${here/rrdPath}/**ONE**.rrd:ds0:FAILURES CDEF:upper=pred,dev,2,*,+ CDEF:lower=pred,dev,2,*,- TICK:fail#ffffa0aa:1.0 AREA:**ONE**#00cc00:**ONELABEL** VDEF:**ONE**_last=**ONE**,LAST GPRINT:**ONE**_last:cur\:%0.2lf%s VDEF:**ONE**_average=**ONE**,AVERAGE GPRINT:**ONE**_average:avg\:%0.2lf%s VDEF:**ONE**_maximum=**ONE**,MAXIMUM GPRINT:**ONE**_maximum:max\:%0.2lf%s\l LINE1:upper#ff4444:Baseline Upper 97.5th Percentile LINE1:lower#ff8844:Baseline Lower 2.5th Percentile Once you have done this, sit back and wait 3*seasonal periods (3 days in my example) before you see the extra lines representing the baseline, as rrd cannot predict anything until it has enough data. And when your done you should see something like this:- [img] http://cricket.sourceforge.net/aberrant/aberrant.png [/img] The only thing I can't work out is how to alert whenever aberrant behaviour is detected. However, having used this for a while now I actually find it useful as post-analysis thing and don't think it would be that useful for alerting unless you are running a super-stable super-predictable network(!). ===== Surfraz Open Systems Intelligence http://www.go-osi.com ------------------------ Surfraz Ahmed -------------------- m2f -------------------- Read this topic online here: http://community.zenoss.com/forums/viewtopic.php?p=10340#10340 -------------------- m2f -------------------- _______________________________________________ zenoss-users mailing list [email protected] http://lists.zenoss.org/mailman/listinfo/zenoss-users
