We cut off the peaks from the RRD graphs on the example of Munin

Any linux administrator has probably seen anomalous peaks on RRD charts. Peaks appear due to a violation of the process of collecting the tracked value and spoil the picture on the graph. This is normal for RRD.

Peaks on the traffic graph may appear after restarting the network interface or after rebooting the server, which is essentially the same thing. In both cases, the counting process will be interrupted due to stopping the device.


')


When peaks appear, it is necessary to remove anomalous values ​​from the RRD database in order for the graph to become informative again. This can be done using the rrdtool utility:
a) manually
rrdtool dump -> xml (find and delete peaks) -> rrdtool restore

b) or by running the removespikes.pl script, the same happens in it, but without your participation.

I use removespikes.pl. The process of cutting peaks takes less than 1 minute.
Munin monitoring is installed on my servers, so examples are given using this monitoring. The method will work with any monitoring based on RRD.

Cut off peaks from traffic eth0 graphs

## ( . « »)
su – munin

## removespikes.pl
wget oss.oetiker.ch/rrdtool/pub/contrib/removespikes-20080226-mkn.tar.gz
tar xvzf removespikes-20080226-mkn.tar.gz
rm removespikes-20080226-mkn.tar.gz

## rrd
## *.rrd.old .
for f in `find ~/localdomain/ -name "localhost.localdomain-if_eth0*.rrd"`
do
## removespikes.pl-orig.
## removespikes.pl , RRD . ( . « »)
~/removespikes/removespikes.pl-orig $f;
done;

After running the script, you should see something like
Chopping peak at <!– 2010-04-25 17:00:00 EEST / 1133247800 –>
Chopping peak at <!– 2010-04-25 19:00:00 EEST / 1130359100 –>

Munin eth0 traffic plots after removespikes.pl

Underwater rocks

Stone number 1
Attention: run the removespikes.pl script under the user of your monitoring or check the rights to the rdd files created by the script, otherwise data collection will not be possible!

On the graph above there is a gap that occurred, due to the fact that I ran removespikes.pl as root. The corrected rrd files were created with the owner of root and munin could not write data to them.

Stone number 2
The removespikes-20080226-mkn.tar.gz archive contains two script modifications: the original (removespikes.pl-orig) and with add. functions (removespikes.pl).

The correctness of removespikes.pl-orig has been repeatedly tested on different servers by me.

But running removespikes.pl I got an unexpected result. Graph as an iron smoothed out: (.



The script has the parameter removespikes.pl
# Threshhold for cutting. Exponents above it will be chopped - all points above this value are cut off.
my $ THRESH = 10000 ;, which corresponds to about 140 Mbit / s.
My traffic was over 140 and fell under this restriction.
If you have the usual 100Mbps, this restriction will not affect the final result.

Conclusion

The script automatically creates backup files with the names * .rrd.old, so you can always return to its original state. The main thing is to create a file search template for the pass removespikes.pl in the for ... in loop.

UPD

The problem with peaks will never occur if you install ethtool with munin. With this utility, munin will determine the maximum speed of the network interface and automatically set a limit.
If there is no ethtool on the server, then at the bottom of the traffic page (if_eth0.html) you will see the message
Traffic of the eth0 interface. Maximum speed is undeterminable (please install ethtool).

After installing apt-get install ethtool, the message will change
Traffic of the eth0 interface. Maximum speed is 1000000000 bits per second.

Sources

howto-remove-spikes-from-rrd-graphs
rrdtool doc