[Xymon] Is there a way to do trend analysis or prediction or anomaly detection with Xymon?

[Jeremy Laidman]

I've been planning to do this type of thing for a while.  I've set this up
under MRTG a few years ago, without really knowing what parameters to use
for the additional consolidation functions, and to my surprise it worked
quite well.

But once the functions are defined in each RRD file, you just need to
adjust your graphs to show them, and presumably you can threshold them by
defining a "DS" setting in analysis.cfg.

Perhaps it's time I re-visited this, and we put together a how-to.  I think
the first thing to do would be to look into updating rrddefinitions.cfg for
each graph you want to adjust, and either delete the RRD files or
export-import somehow to create the CFs.

BTW, useful search keyword is "Holt-Winters".  It's known as "aberrant
behaviour detection".  It makes assumptions about the cyclic behaviour of
data, and calculates the average and standard deviation for different times
of day and days of the week.  A a data point can be compared to the average
+/- some number of deviations, and alerted when outside the range.

On Tue, Jan 31, 2012 at 9:27 AM, <cleaver at terabithia.org> wrote:

> On Mon, January 30, 2012 5:09 am, David de Caires e Freitas wrote:
> > Hi there,
> >
> > Is there a plugin or feature of xymon that anyone knows of that allows
> one
> > to do anomaly detection on the graph data?
> > i.e. if there is nonstandard behavior on the graph that stands out, and
> > you
> > want it to be investigated.
> >
>
> Not natively, as Xymon is designed more around thresholding for alerting.
> However as metrics are stored in rrd files, a separate task could be built
> that read in rrds, calculates trends, and triggers status changes (man
> xymon | grep modify) for those tests based solely on future expectations.
>
> Long term, visual options like those at
> http://hints.jeb.be/2009/12/04/trend-prediction-with-rrdtool/ might be
> useful as well.
>
>
> HTH,
>
> -jc
>
>
> _______________________________________________
> Xymon mailing list
> Xymon at xymon.com
> http://lists.xymon.com/mailman/listinfo/xymon
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.xymon.com/pipermail/xymon/attachments/20120131/ecf5fa04/attachment.html>