RRDtool: Creating a database

RRDtool graphs are much prettier and more versatile than MRTG graphs. Like MRTG they are very complicated to configure, though.

This page is basicely man rrdcreate, but shorter and hopyfully easier to understand.

Creating a database

A round robin database contains one or more data sets (which holds meta information about the data) and one or more archives (which hold the data itself).

The syntax for creating a round robin database looks like 

rrdtool create arpcache.rrd \
        --step 300 \
        DS:num:GAUGE:600:U:U \
        RRA:AVERAGE:0.5:1:2016

How often the database will be updated: --step

This one is easy. The parameter --step is the interval at which the database will be updated, in seconds.

Describing the data that will be hold: DS

You have to tell rrdtool, how the saved data is to be interpreted by rrdtool. The syntax for defining a data (DS) source is 
DS:ds-name:DST:heartbeat:min:max

DS

DS tells RRDtool that this is a definition of a data source.

ds-name

This is just a name describing the contents of the data source.

DST

DST means Data source type. The following DSTs are available:
DST meaning
GAUGE A current, absolute value is saved. RRDtool will use the value without further interpreting it
COUNTER a value that will always add up, like the bytes transferred from a NIC. If the counter overflows, RRDtool will guess the correct value. Note that this is the way kb/s values get computed!
DERIVE Like COUNTER, but without the guessing of overflows. I prefer this to COUNTER.
ABSOLUTE For counters which get reset upon reading.

heartbeat

Heartbeat defines the maximum number of seconds that may pass between two updates of this data source before the value of the data source is assumed to be *UNKNOWN*.

min:max

The minimum and maximum values that can be valid for this data source. If RRDtool is asked to save a value not within this range, the value will be saved as *UNKOWN*. A value of U means unlimited. Always insert 0 here, otherwise rrdtool will try to be clever in certain situations (guessing counter overflows?) and insert insane low negative values.

defining an archive: RRA

RRA means round robin archive. Defining an RRA is the tricky part!

This parameter describes how long you want to hold your data, and in what resolution. There can be more than on archive. If the time span of an archive is full, the data will be consolidated and saved into the next archive.

The format is 

RRA:CF:xff:steps:rows

steps: the resolution of an archive

The interval at which a value will be saved into this archive. In other words, a value will be saved into the archive every steps time. This is the resolution of the archive.

To calculate the resolution, you have to look at the --step parameter. If --step is 300 (5 minutes), steps will result in

value of steps how often a value is saved (resolution) resolution how to get the number
1 every time 5 minutes 1 * 300s = 5m
3 every third time 15 minutes 3 * 300s = 15m
6 every 6th time half an hour 6 * 300s = 30m
12 every 12th time one hour 12 * 300s = 1h
72 every 72th time six hours 72 * 300s = 6h
144 every 144th time 12 hours 144 * 300s = 12h
288 every 288th time 24 hours 288 * 300s = 24h

rows: the time span an archive can hold

The number of values that can be saved into an archive. This parameter defines the time span an archive can hold. To get the needed number of rows you have to divide the wanted time span with the resolution.
12 hours with 15-minute resolution
24 hours with 30-minute resolution
1 year (365 days) with 6-hour resolution
31536000/21600 = 1460
3 years with 6-hour resolution
94608000/21600 = 4380

CF

CF describes, which consolidation function should be used when saving a value into an archive. The following functions are available. They gather their data from the archives with the higher resolution.
AVERAGE The average value of all records in the archive will be saved into the next archive
MIN The smallest value of all records in the archive will be saved into the next archive
MAX The maximume value of all records in the archive will be saved into the next archive
LAST The last value saved in the archive will be saved into the next archive

xff

The "The xfiles factor": how many records can be *UNKOWN* for a consolication not to result in *UNKOWN* itself. Just use 0.5.

Examples

rrdtool create download.rrd \
        --step 300 \
        DS:inet_down_total:DERIVE:600:0:U \
        DS:inet_down_comp1:DERIVE:600:0:U \
        DS:inet_down_comp2:DERIVE:600:0:U \
        DS:inet_down_other:DERIVE:600:0:U \
        RRA:AVERAGE:0.5:1:288 \
        RRA:AVERAGE:0.5:3:672 \
        RRA:AVERAGE:0.5:12:744 \
        RRA:AVERAGE:0.5:72:1460
creates a database that

On the other hand: why bother? A database with one data source holding three years in 5-minute resolution is only 2.5 MB big: 

rrdtool create download.rrd \
        --step 300 \
        DS:inet_down_total:DERIVE:600:0:U \
        DS:inet_down_comp1:DERIVE:600:0:U \
        DS:inet_down_comp2:DERIVE:600:0:U \
        DS:inet_down_other:DERIVE:600:0:U \
	RRA:AVERAGE:0.5:1:315360

some predefined databases

Note: All "1 year" timespans are actually a bit more from here on, so that there is time to make backups at the end of the year before the data gets overwritten. 
RRA:AVERAGE:0.5:12:106560
	
RRA:AVERAGE:0.5:1:4032 \
RRA:AVERAGE:0.5:12:8880
	
RRA:AVERAGE:0.5:1:288 \
RRA:AVERAGE:0.5:3:672 \
RRA:AVERAGE:0.5:12:8880
	
RRA:AVERAGE:0.5:1:288 \
RRA:AVERAGE:0.5:3:672 \
RRA:AVERAGE:0.5:12:744 \
RRA:AVERAGE:0.5:72:1480