![[tokkee]](http://tokkee.org/images/avatar.png){kind=avatar}
diff --git a/doc/rrdtutorial.txt b/doc/rrdtutorial.txt
index 50e358355d86706fa44b7112c81ef1ea257820be..b6bb973b4dde5cf20a995f2681fc89c1a55b357a 100644 (file)
--- a/doc/rrdtutorial.txt
+++ b/doc/rrdtutorial.txt
-N\bNA\bAM\bME\bE
- rrdtutorial - Alex van den Bogaerdt's RRDtool tutorial
+rrdtutorial - Alex van den Bogaerdt's RRDtool tutorial
D\bDE\bES\bSC\bCR\bRI\bIP\bPT\bTI\bIO\bON\bN
RRDtool is written by Tobias Oetiker <tobi@oetiker.ch> with contribu-
tions from many people all around the world. This document is written
- by Alex van den Bogaerdt <alex@ergens.op.het.net> to help you under-
+ by Alex van den Bogaerdt <alex@vandenbogaerdt.nl> to help you under-
stand what RRDtool is and what it can do for you.
The documentation provided with RRDtool can be too technical for some
ment explains the basics and may be boring. But if you don't under-
stand the basics, the examples will not be as meaningful to you.
+ Sometimes things change. This example used to provide numbers like
+ "0.04" in stead of "4.00000e-02". Those are really the same numbers,
+ just written down differently. Don't be alarmed if a future version of
+ rrdtool displays a slightly different form of output. The examples in
+ this document are correct for version 1.2.0 of RRDtool.
+
+ Also, sometimes bugs do occur. They may also influence the outcome of
+ the examples. Example speed4.png was suffering from this (the handling
+ of unknown data in an if-statement was wrong). Normal data will be just
+ fine (a bug in rrdtool wouldn't last long) but special cases like NaN,
+ INF and so on may last a bit longer. Try another version if you can,
+ or just live with it.
+
+ I fixed the speed4.png example (and added a note). There may be other
+ examples which suffer from the same or a similar bug. Try to fix it
+ yourself, which is a great excercise. But please do not submit your
+ result as a fix to the source of this document. Discuss it on the
+ user's list, or write to me.
+
W\bWh\bha\bat\bt i\bis\bs R\bRR\bRD\bDt\bto\boo\bol\bl?\b?
RRDtool refers to Round Robin Database tool. Round robin is a tech-
nique that works with a fixed amount of data, and a pointer to the cur-
- rent element. Think of a circle with some dots plotted on the edge --
- these dots are the places where data can be stored. Draw an arrow from
- the center of the circle to one of the dots -- this is the pointer.
- When the current data is read or written, the pointer moves to the next
- element. As we are on a circle there is neither a beginning nor an end,
+ rent element. Think of a circle with some dots plotted on the edge.
+ These dots are the places where data can be stored. Draw an arrow from
+ the center of the circle to one of the dots; this is the pointer. When
+ the current data is read or written, the pointer moves to the next ele-
+ ment. As we are on a circle there is neither a beginning nor an end,
you can go on and on and on. After a while, all the available places
will be used and the process automatically reuses old locations. This
way, the dataset will not grow in size and therefore requires no main-
tion).
Many examples below talk about SNMP which is an acronym for Simple Net-
- work Management Protocol. "Simple" refers to the protocol -- it does
- not mean it is simple to manage or monitor a network. After working
- your way through this document, you should know enough to be able to
- understand what people are talking about. For now, just realize that
- SNMP can be used to query devices for the values of counters they keep.
- It is the value from those counters that we want to store in the RRD.
+ work Management Protocol. "Simple" refers to the protocol. It does not
+ mean it is simple to manage or monitor a network. After working your
+ way through this document, you should know enough to be able to under-
+ stand what people are talking about. For now, just realize that SNMP
+ can be used to query devices for the values of counters they keep. It
+ is the value from those counters that we want to store in the RRD.
W\bWh\bha\bat\bt c\bca\ban\bn I\bI d\bdo\bo w\bwi\bit\bth\bh t\bth\bhi\bis\bs t\bto\boo\bol\bl?\b?
get used to that right away. Assume a byte is eight bits and start to
think in bits not bytes. The counter, however, still counts bytes! In
the SNMP world most of the counters are 32 bits. That means they are
- counting from 0 to 4'294'967'295. We will use these values in the exam-
+ counting from 0 to 4294967295. We will use these values in the exam-
ples. The device, when asked, returns the current value of the
counter. We know the time that has passes since we last asked so we now
know how many bytes have been transfered ***on average*** per second.
most into miles per hour by dividing km by 1.6 (close enough). I will
use the following abbreviations:
- M: meter
- KM: kilometer (= 1'000 meters).
- H: hour
- S: second
- KM/H: kilometers per hour
- M/S: meters per second
+ m: meter
+ km: kilometer (= 1000 meters).
+ h: hour
+ s: second
+ km/h: kilometers per hour
+ m/s: meters per second
You are driving a car. At 12:05 you read the counter in the dashboard
- and it tells you that the car has moved 12'345 KM until that moment.
- At 12:10 you look again, it reads 12'357 KM. This means you have trav-
- eled 12 KM in five minutes. A scientist would translate that into
- meters per second and this makes a nice comparison toward the problem
- of (bytes per five minutes) versus (bits per second).
-
- We traveled 12 kilometers which is 12'000 meters. We did that in five
- minutes or 300 seconds. Our speed is 12'000M / 300S or 40 M/S.
-
- We could also calculate the speed in KM/H: 12 times 5 minutes is an
- hour, so we have to multiply 12 KM by 12 to get 144 KM/H. For our
- native English speaking friends: that's 90 MPH so don't try this exam-
+ and it tells you that the car has moved 12345 km until that moment. At
+ 12:10 you look again, it reads 12357 km. This means you have traveled
+ 12 km in five minutes. A scientist would translate that into meters per
+ second and this makes a nice comparison toward the problem of (bytes
+ per five minutes) versus (bits per second).
+
+ We traveled 12 kilometers which is 12000 meters. We did that in five
+ minutes or 300 seconds. Our speed is 12000m / 300s or 40 m/s.
+
+ We could also calculate the speed in km/h: 12 times 5 minutes is an
+ hour, so we have to multiply 12 km by 12 to get 144 km/h. For our
+ native English speaking friends: that's 90 mph so don't try this exam-
ple at home or where I live :)
Remember: these numbers are averages only. There is no way to figure
out from the numbers, if you drove at a constant speed. There is an
example later on in this tutorial that explains this.
- I hope you understand that there is no difference in calculating M/S or
- bps; only the way we collect the data is different. Even the K from
- kilo is the same as in networking terms k also means 1'000.
+ I hope you understand that there is no difference in calculating m/s or
+ bps; only the way we collect the data is different. Even the k from
+ kilo is the same as in networking terms k also means 1000.
We will now create a database where we can keep all these interesting
numbers. The method used to start the program may differ slightly from
We created the round robin database called test (test.rrd) which starts
at noon the day I started writing this document, 7th of March, 1999
- (this date translates to 920'804'400 seconds as explained below). Our
+ (this date translates to 920804400 seconds as explained below). Our
database holds one data source (DS) named "speed" that represents a
counter. This counter is read every five minutes (this is the default
therefore you don't have to put "--step=300"). In the same database
We now have to fill our database with some numbers. We'll pretend to
have read the following numbers:
- 12:05 12345 KM
- 12:10 12357 KM
- 12:15 12363 KM
- 12:20 12363 KM
- 12:25 12363 KM
- 12:30 12373 KM
- 12:35 12383 KM
- 12:40 12393 KM
- 12:45 12399 KM
- 12:50 12405 KM
- 12:55 12411 KM
- 13:00 12415 KM
- 13:05 12420 KM
- 13:10 12422 KM
- 13:15 12423 KM
+ 12:05 12345 km
+ 12:10 12357 km
+ 12:15 12363 km
+ 12:20 12363 km
+ 12:25 12363 km
+ 12:30 12373 km
+ 12:35 12383 km
+ 12:40 12393 km
+ 12:45 12399 km
+ 12:50 12405 km
+ 12:55 12411 km
+ 13:00 12415 km
+ 13:05 12420 km
+ 13:10 12422 km
+ 13:15 12423 km
We fill the database as follows:
writes "U" or "UNKN" or something similar that's okay. If something
else is wrong, it will probably be due to an error you made (assuming
that my tutorial is correct of course :-). In that case: delete the
- database and try again. Sometimes things change. This example used to
- provide numbers like "0.04" in stead of "4.00000e-02". Those are
- really the same numbers, just written down differently. Don't be
- alarmed if a future version of rrdtool displays a slightly different
- form of output. The examples in this document are correct for version
- 1.2.0 of RRDtool.
+ database and try again.
The meaning of the above output will become clear below.
magenta #FF00FF (mixed red with blue)
gray #555555 (one third of all components)
- Additionally you can add an alpha channel (transparency). The default
- will be "FF" which means non-transparent.
+ Additionally you can (with a recent RRDtool) add an alpha channel
+ (transparency). The default will be "FF" which means non-transparent.
The PNG you just created can be displayed using your favorite image
viewer. Web browsers will display the PNG via the URL
When looking at the image, you notice that the horizontal axis is
labeled 12:10, 12:20, 12:30, 12:40 and 12:50. Sometimes a label doesn't
- fit (12:00 and 13:00 would be candidates) so they are skipped.
+ fit (12:00 and 13:00 would be likely candidates) so they are skipped.
The vertical axis displays the range we entered. We provided kilometers
and when divided by 300 seconds, we get very small numbers. To be
- exact, the first value was 12 (12'357-12'345) and divided by 300 this
- makes 0.04, which is displayed by RRDtool as "40 m" meaning "40/1'000".
- The "m" (milli) has nothing to do with meters, kilometers or millime-
- ters! RRDtool doesn't know about the physical units of our data, it
- just works with dimensionless numbers.
+ exact, the first value was 12 (12357-12345) and divided by 300 this
+ makes 0.04, which is displayed by RRDtool as "40 m" meaning "40/1000".
+ The "m" (milli) has nothing to do with meters (also m), kilometers or
+ millimeters! RRDtool doesn't know about the physical units of our data,
+ it just works with dimensionless numbers.
If we had measured our distances in meters, this would have been
- (12'357'000-12'345'000)/300 = 12'000/300 = 40.
+ (12357000-12345000)/300 = 12000/300 = 40.
As most people have a better feel for numbers in this range, we'll cor-
rect that. We could recreate our database and store the correct data,
CDEF:realspeed=myspeed,1000,\* \
LINE2:realspeed#FF0000
- Note: Make sure not to forget the backslash \ in front of the multipli-
- cation operator * above. The backslash is needed to "escape" the * as
- some operating systems might interpret and expand * instead of passing
- it to the rrdtool command.
+ Note: I need to escape the multiplication operator * with a backslash.
+ If I don't, the operating system may interpret it and use it for file
+ name expansion. You could also place the line within quotation marks
+ like so:
+
+ "CDEF:realspeed=myspeed,1000,*" \
+
+ It boils down to: it is RRDtool which should see *, not your shell.
+ And it is your shell interpreting \, not RRDtool. You may need to
+ adjust examples accordingly if you happen to use an operating system or
+ shell which behaves differently.
After viewing this PNG, you notice the "m" (milli) has disappeared.
This it what the correct result would be. Also, a label has been added
detail. Also, you may want to read my tutorial on CDEFs and Steve
Rader's tutorial on RPN. But first finish this tutorial.
- Hang on! If we can multiply values with 1'000, it should also be possi-
+ Hang on! If we can multiply values with 1000, it should also be possi-
ble to display kilometers per hour from the same data!
To change a value that is measured in meters per second:
- Calculate meters per hour: value * 3'600
- Calculate kilometers per hour: value / 1'000
- Together this makes: value * (3'600/1'000) or value * 3.6
+ Calculate meters per hour: value * 3600
+ Calculate kilometers per hour: value / 1000
+ Together this makes: value * (3600/1000) or value * 3.6
In our example database we made a mistake and we need to compensate for
- this by multiplying with 1'000. Applying that correction:
+ this by multiplying with 1000. Applying that correction:
- value * 3.6 * 1'000 == value * 3'600
+ value * 3.6 * 1000 == value * 3600
Now let's create this PNG, and add some more magic ...
Note: here we use another means to escape the * operator by enclosing
the whole string in double quotes.
- This graph looks much better. Speed is shown in KM/H and there is even
+ This graph looks much better. Speed is shown in km/h and there is even
an extra line with the maximum allowed speed (on the road I travel on).
I also changed the colors used to display speed and changed it from a
line into an area.
--start 920804400 --end 920808000 \
--vertical-label km/h \
DEF:myspeed=test.rrd:speed:AVERAGE \
- "CDEF:kmh=myspeed,3600,*" \
+ CDEF:nonans=myspeed,UN,0,myspeed,IF \
+ CDEF:kmh=nonans,3600,* \
CDEF:fast=kmh,100,GT,100,0,IF \
CDEF:over=kmh,100,GT,kmh,100,-,0,IF \
CDEF:good=kmh,100,GT,0,kmh,IF \
AREA:fast#550000:"Too fast" \
STACK:over#FF0000:"Over speed"
+ Remember the note in the beginning? I had to remove unknown data from
+ this example. The 'nonans' CDEF is new, and the 6th line (which used to
+ be the 5th line) used to read 'CDEF:kmh=myspeed,3600,*'
+
Let's create a quick and dirty HTML page to view the three PNGs:
<HTML><HEAD><TITLE>Speed</TITLE></HEAD><BODY>
learned so far. Later on we will also be able to monitor other types of
values like temperature.
- Most (?) people interested in RRDtool will use the counter that keeps
- track of octets (bytes) transfered by a network device. So let's do
- just that next. We will start with a description of how to collect
- data.
+ Many people interested in RRDtool will use the counter that keeps track
+ of octets (bytes) transfered by a network device. So let's do just that
+ next. We will start with a description of how to collect data.
Some people will make a remark that there are tools which can do this
data collection for you. They are right! However, I feel it is impor-
The device should answer with a description of itself, perhaps an empty
one. Until you got a valid answer from a device, perhaps using a dif-
- ferent "password", or a different device, there is no point in
- continuing.
+ ferent "password", or a different device, there is no point in continu-
+ ing.
snmpget -v2c -c public myrouter interfaces.ifNumber.0
LINE1:outoctets#0000FF:"Out traffic"
This should produce a picture with one day worth of traffic. One day
- is 24 hours of 60 minutes of 60 seconds: 24*60*60=86'400, we start at
- now minus 86'400 seconds. We define (with DEFs) inoctets and outoctets
+ is 24 hours of 60 minutes of 60 seconds: 24*60*60=86400, we start at
+ now minus 86400 seconds. We define (with DEFs) inoctets and outoctets
as the average values from the database myrouter.rrd and draw an area
for the "in" traffic and a line for the "out" traffic.
more.
Recall all the stuff about the speed of the car. Suppose we drove at
- 144 KM/H during 5 minutes and then were stopped by the police for 25
+ 144 km/h during 5 minutes and then were stopped by the police for 25
minutes. At the end of the lecture we would take our laptop and create
and view the image taken from the database. If we look at the second
RRA we did create, we would have the average from 6 samples. The sam-
ples measured would be 144+0+0+0+0+0=144, divided by 30 minutes, cor-
- rected for the error by 1000, translated into KM/H, with a result of 24
- KM/H. I would still get a ticket but not for speeding anymore :)
+ rected for the error by 1000, translated into km/h, with a result of 24
+ km/h. I would still get a ticket but not for speeding anymore :)
Obviously, in this case we shouldn't look at the averages. In some
- cases they are handy. If you want to know how many KM you had traveled,
+ cases they are handy. If you want to know how many km you had traveled,
the averaged picture would be the right one to look at. On the other
hand, for the speed that we traveled at, the maximum numbers seen is
much more interesting. Later we will see more types.
that keeps averages will show low numbers, the archive that shows max-
ima will have higher numbers.
- For my car this would translate in averages per day of 96/24=4 KM/H (as
+ For my car this would translate in averages per day of 96/24=4 km/h (as
I travel about 94 kilometers on a day) during working days, and maxima
- of 120 KM/H (my top speed that I reach every day).
+ of 120 km/h (my top speed that I reach every day).
Big difference. Do not look at the second graph to estimate the dis-
tances that I travel and do not look at the first graph to estimate my
five minutes, but not if you average.
On some days, I go for a long ride. If I go across Europe and travel
- for 12 hours, the first graph will rise to about 60 KM/H. The second
- one will show 180 KM/H. This means that I traveled a distance of 60
- KM/H times 24 H = 1440 KM. I did this with a higher speed and a maximum
- around 180 KM/H. However, it probably doesn't mean that I traveled for
- 8 hours at a constant speed of 180 KM/H!
+ for 12 hours, the first graph will rise to about 60 km/h. The second
+ one will show 180 km/h. This means that I traveled a distance of 60
+ km/h times 24 h = 1440 km. I did this with a higher speed and a maximum
+ around 180 km/h. However, it probably doesn't mean that I traveled for
+ 8 hours at a constant speed of 180 km/h!
This is a real example: go with the flow through Germany (fast!) and
stop a few times for gas and coffee. Drive slowly through Austria and
Make sure you understand the last few paragraphs. There is no value in
only a line and a few axis, you need to know what they mean and inter-
- pret the data in ana appropriate way. This is true for all data.
+ pret the data in an appropriate way. This is true for all data.
The biggest mistake you can make is to use the collected data for some-
thing that it is not suitable for. You would be better off if you
You know how to create a database and can put data in it. You can get
the numbers out again by creating an image, do math on the data from
- the database and view the resulte instead of the raw data. You know
- about the difference between averages and maxima, and when to use which
- (or at least you should have an idea).
+ the database and view the result instead of the raw data. You know
+ about the difference between averages and maximum, and when to use
+ which (or at least you should have an idea).
RRDtool can do more than what we have learned up to now. Before you
continue with the rest of this doc, I recommend that you reread from
like counter with one difference: RRDtool assumes the counter is reset
when it's read. That is: its delta is known without calculation by RRD-
tool whereas RRDtool needs to calculate it for the counter type. Exam-
- ple: our first example (12'345, 12'357, 12'363, 12'363) would read:
+ ple: our first example (12345, 12357, 12363, 12363) would read:
unknown, 12, 6, 0. The rest of the calculations stay the same. The
other one, derive, is like counter. Unlike counter, it can also
decrease so it can have a negative delta. Again, the rest of the calcu-
what we put in: a sort of a wave.
· Line C is of type DERIVE. It should be a counter that can decrease.
- It does so between 2'400 and 0, with 1'800 in-between.
+ It does so between 2400 and 0, with 1800 in-between.
· Line D is of type ABSOLUTE. This is like counter but it works on val-
ues without calculating the difference. The numbers are the same and
There are a few more basics to show. Some important options are still
to be covered and we haven't look at counter wraps yet. First the
- counter wrap: In our car we notice that the counter shows 999'987. We
- travel 20 KM and the counter should go to 1'000'007. Unfortunately,
- there are only six digits on our counter so it really shows 000'007. If
- we would plot that on a type DERIVE, it would mean that the counter was
- set back 999'980 KM. It wasn't, and there has to be some protection for
+ counter wrap: In our car we notice that the counter shows 999987. We
+ travel 20 km and the counter should go to 1000007. Unfortunately, there
+ are only six digits on our counter so it really shows 000007. If we
+ would plot that on a type DERIVE, it would mean that the counter was
+ set back 999980 km. It wasn't, and there has to be some protection for
this. This protection is only available for type COUNTER which should
be used for this kind of counter anyways. How does it work? Type
counter should never decrease and therefore RRDtool must assume it
compensated for by adding the maximum value of the counter + 1. For our
car this would be:
- Delta = 7 - 999'987 = -999'980 (instead of 1'000'007-999'987=20)
+ Delta = 7 - 999987 = -999980 (instead of 1000007-999987=20)
- Real delta = -999'980 + 999'999 + 1 = 20
+ Real delta = -999980 + 999999 + 1 = 20
At the time of writing this document, RRDtool knows of counters that
are either 32 bits or 64 bits of size. These counters can handle the
following different values:
- - 32 bits: 0 .. 4'294'967'295
- - 64 bits: 0 .. 18'446'744'073'709'551'615
+ - 32 bits: 0 .. 4294967295
+ - 64 bits: 0 .. 18446744073709551615
If these numbers look strange to you, you can view them in their hex-
adecimal form:
Correction numbers:
- - 32 bits: (4'294'967'295 + 1) = 4'294'967'296
- - 64 bits: (18'446'744'073'709'551'615 + 1)
- - correction1 = 18'446'744'069'414'584'320
+ - 32 bits: (4294967295 + 1) = 4294967296
+ - 64 bits: (18446744073709551615 + 1)
+ - correction1 = 18446744069414584320
- Before: 4'294'967'200
+ Before: 4294967200
Increase: 100
- Should become: 4'294'967'300
+ Should become: 4294967300
But really is: 4
- Delta: -4'294'967'196
- Correction1: -4'294'967'196 + 4'294'967'296 = 100
+ Delta: -4294967196
+ Correction1: -4294967196 + 4294967296 = 100
- Before: 18'446'744'073'709'551'000
+ Before: 18446744073709551000
Increase: 800
- Should become: 18'446'744'073'709'551'800
+ Should become: 18446744073709551800
But really is: 184
- Delta: -18'446'744'073'709'550'816
- Correction1: -18'446'744'073'709'550'816
- + 4'294'967'296 = -18'446'744'069'414'583'520
- Correction2: -18'446'744'069'414'583'520
- + 18'446'744'069'414'584'320 = 800
-
- Before: 18'446'744'073'709'551'615 ( maximum value )
- Increase: 18'446'744'069'414'584'320 ( absurd increase, minimum for
- Should become: 36'893'488'143'124'135'935 this example to work )
- But really is: 18'446'744'069'414'584'319
- Delta: -4'294'967'296
- Correction1: -4'294'967'296 + 4'294'967'296 = 0
+ Delta: -18446744073709550816
+ Correction1: -18446744073709550816
+ + 4294967296 = -18446744069414583520
+ Correction2: -18446744069414583520
+ + 18446744069414584320 = 800
+
+ Before: 18446744073709551615 ( maximum value )
+ Increase: 18446744069414584320 ( absurd increase, minimum for
+ Should become: 36893488143124135935 this example to work )
+ But really is: 18446744069414584319
+ Delta: -4294967296
+ Correction1: -4294967296 + 4294967296 = 0
(not negative -> no correction2)
- Before: 18'446'744'073'709'551'615 ( maximum value )
- Increase: 18'446'744'069'414'584'319 ( one less increase )
- Should become: 36'893'488'143'124'135'934
- But really is: 18'446'744'069'414'584'318
- Delta: -4'294'967'297
- Correction1: -4'294'967'297 + 4'294'967'296 = -1
- Correction2: -1 + 18'446'744'069'414'584'320 = 18'446'744'069'414'584'319
+ Before: 18446744073709551615 ( maximum value )
+ Increase: 18446744069414584319 ( one less increase )
+ Should become: 36893488143124135934
+ But really is: 18446744069414584318
+ Delta: -4294967297
+ Correction1: -4294967297 + 4294967296 = -1
+ Correction2: -1 + 18446744069414584320 = 18446744069414584319
As you can see from the last two examples, you need strange numbers for
RRDtool to fail (provided it's bug free of course), so this should not
time+900: 900 delta=300 time+900: 900 delta=297
Let's create two identical databases. I've chosen the time range
- 920'805'000 to 920'805'900 as this goes very well with the example num-
- bers.
+ 920805000 to 920805900 as this goes very well with the example numbers.
rrdtool create seconds1.rrd \
--start 920804700 \
W\bWR\bRA\bAP\bPU\bUP\bP
It's time now to wrap up this tutorial. We covered all the basics for
- you to be able to work with RRDtool and to read the additional
- documentation available. There is plenty more to discover about RRDtool
- and you will find more and more uses for this package. You can easly
- create graphs using just the examples provided and using only RRDtool.
- You can also use one of the front ends to RRDtool that are available.
+ you to be able to work with RRDtool and to read the additional documen-
+ tation available. There is plenty more to discover about RRDtool and
+ you will find more and more uses for this package. You can easily cre-
+ ate graphs using just the examples provided and using only RRDtool. You
+ can also use one of the front ends to RRDtool that are available.
M\bMA\bAI\bIL\bLI\bIN\bNG\bGL\bLI\bIS\bST\bT
Remember to subscribe to the RRDtool mailing list. Even if you are not
basic questions. They will not only get their answers, but at the same
time learn a whole lot more.
- Alex van den Bogaerdt <alex@ergens.op.het.net>
+ Alex van den Bogaerdt <alex@vandenbogaerdt.nl>
-1.3.5 2008-03-15 RRDTUTORIAL(1)
+1.3.7 2009-02-21 RRDTUTORIAL(1)