Ok, so then it should be checking the profiles I have added to the holtwinter.dat file correct? And these are profile names, not the individual RRD filenames?
For instance, I have groups created and then profiles within the group and each profile has multiple channels. How should they be defined in the holtwinter.dat file? I currently have this: CEN_K12/CEN_K12_Internet1 CEN_K12/CEN_K12_Web Where CEN_K12 is the group and CEN_K12_Internet1, CEN_K12_Web are the profiles, each of which contains 2 channels. Didn't think I'd ever say this, but I can't wait to have an anomaly to see how this works! Thanks, Robin -----Original Message----- From: Werner Schram [mailto:[EMAIL PROTECTED] Sent: Tuesday, June 12, 2007 11:14 AM To: Brown, Robin Cc: [email protected] Subject: Re: [Nfsen-discuss] Holtwinter alert plugin Hi Robin, Brown, Robin wrote: > I installed the plugin. I used the --defaults directive to the > rrd_hwreapply command to introduce the HW stuff into an rrd. > > Install seems successful, but I have no graph in the alerts tab for the > HW alert created as per the Install document. The graph in the alerts tab is not created by the plugin, but by nfsen itself and is meant for alerts conditioned on total flow summary. So it is not related to plugin based alerts. However, I might be able to addapt the plugin to replace the graphs with a custom graph. I will try this and let you know if I succeeded. > I have the following in > messages: > > Jun 6 11:48:00 munchies nfsen[24391]: Loading plugin 'holtwinter': > Success > Jun 6 11:48:00 munchies nfsen[24391]: ** Important **: Plugin > 'holtwinter' is a legacy plugin. > Jun 6 11:48:00 munchies nfsen[24391]: Initializing plugin 'holtwinter': > Success > Jun 6 11:48:00 munchies nfsen[24391]: plugin 'holtwinter': Profile > plugin: 0, Alert condition plugin: 1, Alert action plugin: 0 > Jun 6 11:48:00 munchies nfsen[24391]: Plugin: 'holtwinter' has > configured profiles, but no 'run' function! > Jun 6 11:48:00 munchies nfsen[24391]: Plugins for Alert conditions: > holtwinter > > Not sure if the no 'run' function is really a problem? No. For plugins in the plugin tab the run function is required, but it is not used for alert-plugins. The plugin initialization code does not distinct ordinary plugins from alert plugins (yet) during this check, so it gives this warning. > Should the > alerts infos graph be populated ongoing or only after an alert has been > triggered? > > Any recommendation to use other values than --defaults when running > rrd_hwreapply? > Well, at least I can tell you what I know about the parameters: Keep in mind that the nfsen rrd data has a 5 minute time window. The Holt-Winters algorithm makes a prediction based on historical data using seasonal patterns. I don't know if you know Gabor Kiss's slides, but if you don't, they might give a good introduction into the algorithm: http://bakacsin.ki.iif.hu/~kissg/project/nfsen-hw/JRA2-meeting-at-Espoo_ slides.pdf --season denotes the length of the seasonal pattern. The default is 288, which corresponds to 288*5=1440 minutes=1day. So the script assumes that your nfsen data has a recurring pattern which spans one day. I think that this will be right in most situations. --rralen denotes the amount of Holt-Winters data that is stored and has a default of 4032, which corresponds to 4032*5=20160 minutes=2 weeks of data. So this means the algorithm can look back 2 weeks at max. according to http://www-iepm.slac.stanford.edu/monitoring/forecast/hw.html : --alpha is basically the short term parameter. A large value of --alpha will give a large weight to measurements very near in the past, while a small value of --alpha will give more weight to measurements further in the past. --gamma is the trend parameter. A big value of --gamma will give more weight to the difference of the last smoothed observations; while a little value of --gamma will use information further in the past. --beta is the seasonal parameter. A big value of --beta will give a big weight to the present relation between the observation and the smoothed observation, and little values of --beta will give more weight to past weeks relation between the observation and the smoothed observation. The --deltapos and --deltaneg (both have a default value of 2) define the scaling factor of the upper and lower confidence band of the prediction. If a value is outside of the confidence band of the prediction it is considered a violation. So using larger values for these parameters, reduces the possibility of false positives, but increases the possibility of false negatives. --failure-threshold (default 6) and --window-length (default 9) define the rate of violations that define a failure, so the default means that an failure is reported when there are at least 6 violations out of 9. these pages might give some more information: http://rrfw.sourceforge.net/rrdman/rrd_hwreapply.pod.html http://oss.oetiker.ch/rrdtool/doc/rrdtune.en.html http://oss.oetiker.ch/rrdtool/doc/rrdcreate.en.html I hope this helps. Werner ------------------------------------------------------------------------- This SF.net email is sponsored by DB2 Express Download DB2 Express C - the FREE version of DB2 express and take control of your XML. No limits. Just data. Click to get it now. http://sourceforge.net/powerbar/db2/ _______________________________________________ Nfsen-discuss mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
