Predictive monitoring

[Gunsthall]

Hi.

Predictive monitoring was discussed a few years ago as a "future" feature for Zabbix. Any idea what´s the situation on this issue?

I think it´s a fantastic idea and I don´t see why it couldn´t be implemented with the existing algortihms and the good collection of data that Zabbix can handle.

This will be a huge improvement for the already great Zabbix tool.

Regards,

Alvaro

[Alexei]

I believe that trend prediction is something to be seriously considered for 2.2. It is not too difficult to implement, it just has to be done once and forever.

[angelhc]

Hi all!

After some time waiting for this feature, Is any news about it? I think it would be so usefull!
I didnt find any reference about it on the 2.2 documentation.

Thanks a lot

[johansen]

would like to add that we are very interested in this as well. any news on this?

[BDiE8VNy]

You possibly want to vote for ZBXNEXT-922 - when not already done of course

[johansen]

it's done now

[mushero]

We are very interested in this and doing development on our own but need ideas and thoughts on what is best - and what you mean by predictive.

For us, this is both trending like declining disk space and anomaly detection from load data, plus rule engines and history look-back like avg CPU today vs. last week (a bit of which can be done now).

But if you have ideas we'd love to hear them and work on building them to give back. Some of this will need TSDB support at higher volumes.

Steve
CEO
ChinaNetCloud

[[email protected]]

Take a look at this paper that talks about what is in RRDTool

http://usenix.org/legacy/publications/library/proceedings/lisa2000/full_papers/brutlag/brutlag_html/index.html

This learns patterns after about 10 cycles, so in about two weeks it will have a good handle on your daily variation, in about two months it will catch on to the weekend changes, etc.

This capability is _really_ nice in that it lets you have an alert for "traffic is unusually high" at 3am on sunday at the same value that would generate an alert for "traffic is unusually low" at 9am monday morning

other links that may be useful

slides for the usenix presentation

http://www.hpl.hp.com/news/events/csc/2005/jake_slides.pdf

notes and man page documentation on the rrd implementation of it

http://cricket.sourceforge.net/aberrant/rrd_hw.htm

https://oss.oetiker.ch/rrdtool/doc/rrdcreate.en.html

[glebs.ivanovskis]

Interesting reading, thank you!

ZBXNEXT-922 is done now, so here are a few related issues where you can share ideas, discuss and vote :

https://support.zabbix.com/browse/ZBXNEXT-2463

https://support.zabbix.com/browse/ZBXNEXT-2579

https://support.zabbix.com/browse/ZBXNEXT-2972

https://support.zabbix.com/browse/ZBXNEXT-2696

[[email protected]]

Thanks, I've looked at them and added some comments.

ZBXNEXT-922 adds a couple of functions, but it seems that they are only useful for triggers, not for something that would show the expected value (or derivative like expected value +- 1 standard deviation).

If there is a way to take the predictive functions that 922 adds and turn them into data items that can be graphed and referenced like other data items, I'm not seeing it.

[glebs.ivanovskis]

If there is a way to take the predictive functions that 922 adds and turn them into data items that can be graphed and referenced like other data items, I'm not seeing it.

Any supported trigger function can be used in calculated items. Take a look at this for example.

[angelhc]

As I can see on documentation there's a new item called "forecast":


forecast (sec|#num,<time_shift>,time,<fit>,<mode>)
Future value, max, min, delta or avg of the item. sec or #num - evaluation period in seconds or in latest collected values specified (preceded by a hash mark)
time_shift (optional) - see avg()
time - forecasting horizon in seconds
fit (optional) - function used to fit historical data

Supported fits:
linear - linear function
polynomialN - polynomial of degree N (1 <= N <= 6)
exponential - exponential function
logarithmic - logarithmic function
power - power function

Note that:
linear is default, polynomial1 is equivalent to linear

mode (optional) - demanded output

Supported modes:
value - value (default)
max - maximum
min - minimum
delta - max-min
avg - average

Note that:
value estimates item value at the moment now + time
max, min, delta and avg investigate item value estimate on the interval between now and now + time Supported value types: float, int

If value to return is larger than 999999999999.9999 or less than -999999999999.9999, return value is cropped to 999999999999.9999 or -999999999999.9999 correspondingly.

Becomes not supported only if misused in expression (wrong item type, invalid parameters), otherwise returns -1 in case of errors.

Examples:
⇒ forecast(#10,,1h) → forecast of item value after one hour based on last 10 values
⇒ forecast(1h,,30m) → forecast of item value after 30 minutes based on last hour data
⇒ forecast(1h,1d,12h) → forecast of item after 12 hours based on one hour one day ago
⇒ forecast(1h,,10m,exponential) → forecast of item value after 10 minutes based on last hour data and exponential function
⇒ forecast(1h,,2h,polynomial3,max) → forecast of maximum value item can reach in next two hours based on last hour data and cubic (third degree) polynomial

This function is supported since Zabbix 3.0.0.
See also additional information on predictive trigger functions.

Regards!