[collectd] Hit counter in threshold

[Florian Forster]

Hi again,

On Tue, Jul 07, 2009 at 02:08:38PM +0200, Andrés J. Díaz wrote:
> I also planned to create a new patch which calculate the average
> values in the cache, and so create a flap detection (percent of state
> changes) and match "heuristic" threshold, that is "for 7 hits threre
> are an 80% of values match with threshold", i think that it's your
> idea too :)

yeah, there are at least two more interesting concepts I'd like to
include at some point:

 1) hysteresis, i. e. something like this:
    -- 8< --
      if (value > (threshold + epsilon))
        status = bad
      else if (value < (threshold - epsilon))
        status = good
      return status
    -- >8 --
    This, used right, should provide modest flapping protection.

 2) sliding windows to calculate aggregate functions of the last
    x values. This is probably very close to what you describe above.
    Those windows could be used to calculate:
    · The number (or percentage) of missing values.
    · The average/minimum/maximum of the last n values (this should fit
      your CPU example).
    · The standard deviation, median, expected next value (using some
      form of extrapolation), … of/based on the last n values (for those
      with academic requirements ;)
    
Both things could either be added to `utils_cache.c:uc_get_rate' or
`src/match_value.c'. Adding the logic to `uc_get_rate' may allow GETVAL
to make use of these options in the future, but that's just a crazy
idea. If necessary, it shouldn't be a big problem to move the code
around.

Regards,
-octo
-- 
Florian octo Forster
Hacker in training
GnuPG: 0x91523C3D
http://verplant.org/
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: Digital signature
Url : http://mailman.verplant.org/pipermail/collectd/attachments/20090711/5b9a10e0/attachment.pgp