A better delta() for triggers

[Pato]

Max() - Min(), or for that matter Delta() calculates a difference, it returns always a positive number
I would like to know the slope instead. Specifically the biggest decrease size of the last two weeks.
This is good for forecasting, much better than any linear extrapolation.

To put it in graphics



Yes, this is free disk space, and Delta() is not good enough because what is needed is exclusively Usage Growth while ignoring any Space Addition (How much space my app is known to allocate in a given period)

Is it possible to calculate this in some way with the available functions?

[kloczek]

What you mean "slop"?
Slope it i the line like y(t)=a*t+b

[Pato]

Using "Slope" might be unfortunate. I am not looking for the angle. I need a MAX - a MIN that happened later in time. The largest one.

Reusing the graph above:



If every square is 1GB

On Day 2 the Largest previous decease is 4.8GB - 1GB = 3.8GB
On Day 3 the Largest previous decease is 4.8GB - 0GB = 4.8GB (>3.8GB)
On Day 4 the Largest previous decease is 7.2GB - 2.2GB = 5GB (>4.8GB >3.8GB)

Until I find a solution I am using the built in delta() which gives me a usable but exagerated value
On Day 2 -> 3.8GB
On Day 3 -> 4.8GB (Morning)
On Day 3 -> 7.2GB (Evening)
On Day 4 -> 7.8GB

[kloczek]

OK so you want to have on presentation layer something you've draw?
If that is what you want try now to think about linear series of data and how to find on "y(t)" points to anchor those arrows.
Than you need to find the point in the zabbix to anchor execution of those analitical routines to produce x1,y1,x2,y2,arrow_direction,value sixtets to draw them on the graph.

I'm not trying to tell that that this presentation layer is bad/useless .. I'm only trying to introduce you to kind of begin of that feature introduction process to the zabbix.

Other thing is that now zabbix is not verge of introduction of new types of the graphs which no longer will be pixmap. You can check what is possible to have in zabbix 4.2 OOTB dashboard which is listed in list of dashboards as "Zabbix server health". That dashboard is using new types of the graphs drawn on web browser side using java script so after that it may be way easier to implement such analytical tools as java script code working 100% on web browser side.

[Pato]

Actally the graphs here were only to help me explain which value I am looking for (to be use in a trigger), no need to present anything
All I need is (function/formula to get) the 5GB value (on day4/now)
That represents the max space allocated/used recently. This helps the trigger know if there is enough free space (at least 5GB) or the disks need to be enlarged.

This helped on day 3, there was a Warning saying I needed at least 4.8GB free (therefore the disk that day was enlarged 5GB from 3.2GB free to 7.2GB
But on day 4 it is telling me that the disks need at least 7.8GB free and sends another warning, whereas I needed only 5GB now free to be on the safe side (because it is taking into account the new MAX I created), and there is no need for a warning (since 7.8GB are enough at the moment)

[kloczek]

Actally the graphs here were only to help me explain which value I am looking for (to be use in a trigger), no need to present anything

%$&! .. my fault

OK, so what you see on the graph is the series of the data of the single metric in "all" mode which means that "all" three values assigned to the trend point (min, avg and max) are presented as band in which data have been changing in the past.

[Pato]

The graph is

vfs.fs.size[C:, free].last()

I have a calculated item (once a day) called spikesize defined (until I find something better that takes only decreases and ignores increases) as

delta("vfs.fs.size[C:, free]",2w)

The trigger is

{vfs.fs.size[C:, free].last()} < {free.space.spikessize[C:].last()}

In words:

If the current free space is smaller than the largest recent usage spike, warn, we need to enlarge the disk to increase the free space

How I imagine the solution:
1. Record every time there is a max value
2. For every Max value of the last two weeks, find a minimum with a contrained period (from the max value timestamp till now)
3. Calculate all diferences
4. Give me the largest difference.

I need a smarter calculated item [the aforementioned "better delta()" ]

[Pato]

Ok, I have it, I can achieve something better by removing the increments from the comparison.

I need two new items:

Recent Maximum:

free.space.recentmax[C:] = max("vfs.fs.size[C:, free]", 2w)

Recent Maximum Variation:

free.space.maxdelta[C:] = Delta(free.space.recentmax[C:])

The trigger changes from

{vfs.fs.size[C:, free].last()} < {free.space.spikessize[C:].last()}

to

{vfs.fs.size[C:, free].last()} < {free.space.spikessize[C:].last()- free.space.maxdelta[C:]

Still not perfect though, I will not get the value of the third spike until the second becomes older than 2 weeks.