There are a number of times where the data collected may appear so erratic that it is difficult to identify any trends. While use of a VDEF can provide a gross average of a data set, it doesn’t provide the utility of a true running average. The running average can provide a consistent calculation regardless as to the time scale displayed in the graph. Fortunately, RRDTool provides a flexible means via its TREND operator for calculating a running average to address this need.
To begin, setup a chart that graphs the desired data in a typical manner before adding in the running average. The following graph command creates a somewhat typical visualization of the last day’s network traffic as illustrated by the following graph:
rrdtool graph example.png \ --title "Network Traffic" \ --width=500 \ --slope-mode \ --end=now \ --start=end-24h \ --base=1000 \ DEF:bytesIn=network.rrd:bytesIn:AVERAGE \ DEF:bytesOut=network.rrd:bytesOut:AVERAGE \ CDEF:bpsIn=bytesIn,8,* \ CDEF:bpsOut=bytesOut,8,* \ CDEF:bpsOutNeg=bpsOut,-1,* \ VDEF:bpsInTot=bpsIn,TOTAL \ VDEF:bpsOutTot=bpsOut,TOTAL \ COMMENT:" current min max total\n" \ AREA:bpsIn#FF880044:"Bits/s In " \ GPRINT:bpsIn:LAST:"%6.1lf%s\t" \ GPRINT:bpsIn:MIN:"%6.1lf%s\t" \ GPRINT:bpsIn:MAX:"%6.1lf%s\t" \ GPRINT:bpsInTot:"%6.1lf%s\n" \ LINE1:bpsIn#FF8800CC \ AREA:bpsOutNeg#44C80044:"Bits/s Out" \ GPRINT:bpsOut:LAST:"%6.1lf%s\t" \ GPRINT:bpsOut:MIN:"%6.1lf%s\t" \ GPRINT:bpsOut:MAX:"%6.1lf%s\t" \ GPRINT:bpsOutTot:"%6.1lf%s\n" \ LINE1:bpsOutNeg#44C800CC \ HRULE:0#000000
With the basic graph setup, adding the elements necessary for the running average can now begin. In this example, it appears there is a roughly hourly cycle (Time Machine backups) that defines the period so a reasonable start is to work with a minimum average calculated over 60 minutes.
First, additional CDEF statements need to be declared applying the TREND operator to the desired data. The format for this operation is straightforward:
CDEF:label=data_source,time_span,TREND
In this case, two new data sources are defined and are given the labels bspInTrend and bpsOutTrendNeg. The data sources for these are the previously declared bpsIn and bpsOutNeg and the time span for them is 1 hour (3600 seconds).
CDEF:bpsInTrend=bpsIn,3600,TREND \ CDEF:bpsOutTrendNeg=bpsOutNeg,3600,TREND \
With the running averages now defined, it is possible to graph the data. For the purposes of this example, the running average is graphed as a “shadow” on top of the base data.
LINE2:bpsInTrend#000000CC \ LINE2:bpsOutTrendNeg#000000CC \
The graph shown below illustrates the new running averages.
The running averages are now shown and it illustrates that despite the hourly peaks, the overall trend is fairly flat with the slight exception around 00:15. However, the running averages also show a gap at the beginning of the graph. This gap is because it takes an hour of data before the hourly running average can be computed. While this may be acceptable, it doesn’t look polished.
A minor tweak of the original DEF statements can provide “padding” necessary to eliminate the displayed gap in the running average lines. This can be accomplished by extending the start time of the data sources by at least the same duration specified in the running averages. Note that the display area is not affected by altering the start time of the DEF statements — that is controlled by the --start and --end options. For the example data, the DEF statements need to extend the range of the data set by 1 hour so as to encompass 25 hours instead of the display area’s 24 hours:
DEF:bytesIn=network.rrd:bytesIn:AVERAGE:start=end-25h \ DEF:bytesOut=network.rrd:bytesOut:AVERAGE:start=end-25h \
Putting it together, the following command will pull in all the data necessary to calculate a running average for the extent of the display area, calculate the running averages, and display the results:
rrdtool graph example.png \ --title "Network Traffic" \ --width=500 \ --slope-mode \ --end=now \ --start=end-24h \ --base=1000 \ DEF:bytesIn=network.rrd:bytesIn:AVERAGE:start=end-25h \ DEF:bytesOut=network.rrd:bytesOut:AVERAGE:start=end-25h \ CDEF:bpsIn=bytesIn,8,* \ CDEF:bpsOut=bytesOut,8,* \ CDEF:bpsOutNeg=bpsOut,-1,* \ CDEF:bpsInTrend=bpsIn,3600,TREND \ CDEF:bpsOutTrendNeg=bpsOutNeg,3600,TREND \ VDEF:bpsInTot=bpsIn,TOTAL \ VDEF:bpsOutTot=bpsOut,TOTAL \ COMMENT:" current min max total\n" \ AREA:bpsIn#FF880044:"Bits/s In " \ GPRINT:bpsIn:LAST:"%6.1lf%s\t" \ GPRINT:bpsIn:MIN:"%6.1lf%s\t" \ GPRINT:bpsIn:MAX:"%6.1lf%s\t" \ GPRINT:bpsInTot:"%6.1lf%s\n" \ LINE1:bpsIn#FF8800CC \ AREA:bpsOutNeg#44C80044:"Bits/s Out" \ GPRINT:bpsOut:LAST:"%6.1lf%s\t" \ GPRINT:bpsOut:MIN:"%6.1lf%s\t" \ GPRINT:bpsOut:MAX:"%6.1lf%s\t" \ GPRINT:bpsOutTot:"%6.1lf%s\n" \ LINE1:bpsOutNeg#44C800CC \ LINE2:bpsInTrend#000000CC \ LINE2:bpsOutTrendNeg#000000CC \ HRULE:0#000000








