I've been planning to do this type of thing for a while. I've set this up under MRTG a few years ago, without really knowing what parameters to use for the additional consolidation functions, and to my surprise it worked quite well.

But once the functions are defined in each RRD file, you just need to adjust your graphs to show them, and presumably you can threshold them by defining a "DS" setting in analysis.cfg.

Perhaps it's time I re-visited this, and we put together a how-to. I think the first thing to do would be to look into updating rrddefinitions.cfg for each graph you want to adjust, and either delete the RRD files or export-import somehow to create the CFs.

BTW, useful search keyword is "Holt-Winters". It's known as "aberrant behaviour detection". It makes assumptions about the cyclic behaviour of data, and calculates the average and standard deviation for different times of day and days of the week. A a data point can be compared to the average +/- some number of deviations, and alerted when outside the range.

On Tue, Jan 31, 2012 at 9:27 AM, <cleaver at terabithia.org> wrote:

On Mon, January 30, 2012 5:09 am, David de Caires e Freitas wrote:

...

Hi there,

Is there a plugin or feature of xymon that anyone knows of that allows one to do anomaly detection on the graph data? i.e. if there is nonstandard behavior on the graph that stands out, and you want it to be investigated.

Not natively, as Xymon is designed more around thresholding for alerting. However as metrics are stored in rrd files, a separate task could be built that read in rrds, calculates trends, and triggers status changes (man xymon | grep modify) for those tests based solely on future expectations.

Long term, visual options like those at http://hints.jeb.be/2009/12/04/trend-prediction-with-rrdtool/ might be useful as well.

HTH,

-jc

---

Xymon mailing list Xymon at xymon.com http://lists.xymon.com/mailman/listinfo/xymon