Latest data Graph summary values convergence

[stan.vasiljev]

During testing of Zabbix trapper items I found some convergences in summary values of item data graph and actual item data values.

On the simple graph of item I saw flat line at ~85 KB level and interesting summary:
[all] [min:76.83 KB max:90.71 KB last:85.08 KB]

But, when I switched it from "Graph" to "500 latest values"
2009-06-24 13:21:06 1245864066 92890
2009-06-24 13:21:06 1245864066 89789
2009-06-24 13:21:06 1245864066 78678

Line was flat, because of all 3 values were inserted at the same time, but why the last: = 85.08 KB on graph's summary instead of 90.71 KB ?

Version info:
zabbix_server -V
ZABBIX Server (daemon) v1.6.5 (revision 7442) (3 April 2009)

[richlv]

how large was the displayed period ?
if it was long enough, trend values were used for graphing, and those are calculated per hour

[stan.vasiljev]

displayed period = 2 hours 30 min - from 2009-06-24 11:13 till 2009-06-24 13:40

At this period were received 3 values (they listed in first post). Last value was 92890 (90.71 KB) and it was maximum value and it was correctly displayed in summary:
[all] [min:76.83 KB max:90.71 KB last:85.08 KB]

But why "last:" in summary = 85.08 KB instead of 90.71 KB

[richlv]

ok, i believe zabbix does not have sub-second precision, thus ordering for three values, received in the same second, is undefined. i wouldn't be surprised if refreshing the graph/latest values would change the outcome

[stan.vasiljev]

Today I can see equal picture - values, graph and summary are the same as for yesterday. No changes at all.

Main reason of my post - to understand why graph's summary decide to show wrong last value, if we have 3 values, received in one time, and have correct order on "500 latest values" with the correct latest value

[richlv]

how do you determine which is "correct" latest value if they all have identical timestamps ?

[stan.vasiljev]

I sent it manually by zabbix_sender, so I know order of values and "500 latest values" page has correct order - equal to send order.

[richlv]

that's not what i meant
if all values have the _exact_ same timestamp, how should zabbix determine their order ?
the fact that they are ordered as you think is correct somewhere can be considered a coincidence (or maybe data is sorted by index somewhere, but that doesn't change the fact that these values have arrived simultaneously for all zabbix cares).

[stan.vasiljev]

Actually "last:" value in summary line of the simple item graph is calculated as average of all values received at the last clock.
Initially I had souce values:
2009-06-24 13:21:06 1245864066 92890
2009-06-24 13:21:06 1245864066 89789
2009-06-24 13:21:06 1245864066 78678

and "last:" = 85.08 KB

But when source value has been updated to this:
| itemid | clock | value |
+--------+------------+-------+
| 22162 | 1245864066 | 8678 |
| 22162 | 1245864066 | 89789 |
| 22162 | 1245864066 | 92890 |

"last:" became = 62.29 KB.

So, that is why that thread has been created - to understand implicit logic of graph summary.

There is source of "last:" function:

function getLastValue($num){
$data = &$this->data[$this->items[$num]['itemid']][$this->items[$num]['calc_type']];
if(isset($data)) for($i=$this->sizeX-1;$i>=0;$i--){
if(isset($data->count[$i]) && ($data->count[$i] > 0)){
switch($this->items[$num]['calc_fnc']){
case CALC_FNC_MIN: return $data->min[$i];
case CALC_FNC_MAX: return $data->max[$i];
case CALC_FNC_ALL: /* use avg */
case CALC_FNC_AVG:
default: return $data->avg[$i];
}
}
}
return 0;
}


Maybe, in some circumstances, "last:" can be max or min value of array of values received simultaneously.

I think I got the answer on my initial question

[richlv]

interesting information, thanks.
so it means if there are multiple values in the same second and average is graphed, 'last' will show average from all these values, right ?
i believe this is mostly a theoretical situation as you probably won't receive many values in a single second in a real environment

[stan.vasiljev]

I agree, that It's theoretical for Zabbix agent&SNMP items polling.
But for trapper items it's real situation. Because of traps can come simultaneously - they don't have polling interval
Simple example - if you will use zabbix_sender to send data to zabbix server using -i option (batch input from file) - most of values will be inserted with the same clock values - you will get one or more arrays of simultaneous values.