How To Remove Spikes From Cacti Graphs

Locate the graph with the Spike:

Click on the Spanner icon to the right of the graph to determine the name of the Round Robin Database (RRD) file that requires changing.

In this case the rrd file name is /opt/cacti-0.8.7e/rra/mx1_lon_uk_traffic_in_20683.rrd. In the remainder of this description we will use this rrd file. In your case you will need to change the name appropriately.

Click on the Magnifying Glass icon to the right of the graph and select the time period you wish to zoom into.

Continue 'zooming' until you can determine the date and time range of the Spikes. In the above case one spike occurred on 19/01/2016 and the other on 26/01/2016

Using the Epoch & Unix Timestamp Conversion Tool found at http://www.epochconverter.com/ convert the date/times into their UTC equivalent as Cacti stored its date and time in UTC format.

In this case the UTC ranges are 1453161601 - 1453247999 and 1453766401 - 1453852799. We can also see that the data values on the graph are in the range of 3x10e12 (3.0Tbits) and 3.5x10e12 (3.5Tbits). The RRD Files stores the information in Bytes so we have to divide by 8 to get the magnitude of bytes. (The are 8 bits in a byte). In this case we are looking for data values in the RRD file around 3.75x10e11 and 4.375x10e11

Log into prod-cacti01-fra-de.geant.net

Change to the /tmp directory and export the data to an XML file format.

rrdtool dump /opt/cacti/rra/mx1_lon_uk_traffic_in_20683.rrd > /tmp/mx1_lon_uk_traffic_in_20683.rrd.xml

Edit the /tmp/mx1_lon_uk_traffic_in_20683.rrd.xml and find the offending data. As we know the data is in the order of 10e11, we can search for the following string e+11

<row><v> 3.5642652369e+07 </v><v> 1.1136736365e+06 </v></row>
 <row><v> 9.0115656678e+07 </v><v> 3.1514951986e+06 </v></row>
 <row><v> 3.8543163654e+11 </v><v> 9.2684560857e+09 </v></row>
 <row><v> 8.0043154538e+07 </v><v> 2.7647348898e+07 </v></row>
 <row><v> 1.0178635224e+08 </v><v> 2.1954640988e+07 </v></row>
 <row><v> 6.5086071137e+07 </v><v> 2.7845010247e+07 </v></row>

<row><v> 3.0217637424e+07 </v><v> 2.4722224375e+07 </v></row>
 <row><v> 7.9918286563e+07 </v><v> 2.1599139048e+07 </v></row>
 <row><v> 4.4333612638e+11 </v><v> 2.0011783987e+10 </v></row>
 <row><v> 7.5003371999e+07 </v><v> 1.8443001057e+06 </v></row>
 <row><v> 7.2175201113e+07 </v><v> 4.0701536470e+05 </v></row>
 <row><v> 6.3959119353e+07 </v><v> 1.9703085506e+05 </v></row>

You can observe that around the spike, the data was in the order of 10e7, so a more meaningful data value would be to do a search and replace for e+11 and replace it with e+07.

Make the necessary changes in the text editor, then save your changes. (You may find it easier to WinSCP this file to your local machine for editing in a different text editor)

Create a backup of the file you wish to change. Please note we are using mv and not cp as we will be unable to restore and rrd file if it exists already onthe file system.

sudo -u cactiuser mv /opt/cacti/rra/mx1_lon_uk_traffic_in_20683.rrd /opt/cacti/rra/mx1_lon_uk_traffic_in_20683.rrd.bak

Recreate the RRD file using the data from the exported XML file.

sudo -u cactiuser rrdtool restore /tmp/mx1_lon_uk_traffic_in_20683.rrd.xml /opt/cacti/rra/mx1_lon_uk_traffic_in_20683.rrd

We now need to sync this change with the other production instance of Cacti on prod-cacti02-vie-at.geant.net

sudo -u cactiuser scp -i /home/cactiuser/.ssh/id_dsa /opt/cacti/rra/mx1_lon_uk_traffic_in_20683.rrd cactiuser@prod-cacti02-vie-at.geant.net:/opt/cacti/rra/mx1_lon_uk_traffic_in_20683.rrd

Page tree

How To Remove Spikes From Cacti Graphs