Problems with history data graph--where does zabbix get history data?

[tfqzab]

I've confronted with this problem for a long time.When I see a graph, for example the flow of interface fa1/0/24, when I look over the history data for a period, like 2 weeks, the maximum value listed usually is not drawn in the graph.
The max value listed in below the graph is 13.65M, but the highest point is only a little bit higher than 7M in the graph, shown in the following picture:



When I use debug mode, I find when drawing history data graphs, zabbix does not get data from the history table in the database, but from the trend table. This may cause some errors. Is that so?
Any suggestion is appreciated. Thanks.

[tfqzab]

call for help.

[keul]

Can't see the picture. Search for a better image host provider.

For each zabbix items, you can set history time (default : 90days) and the trend time( default : 356days)

Zabbix stores history in history tables (one table for each type of history : number, floating number, text...) witch can take a lot of space.

To get more data in history, zabbix converts raw data older than history time and younger than trend time to trend data (that include min/max/avg
for a set of multiple values) witch is less detailed but witch will tale less space in DB (like taking a thumbnail of a picture : you can store more thumbnails in one screen but you lose the details.

SO, when you will look at your graphs in the past/ zabbix will search in history AND / OR trend table depending if tour graph displays data older AND / OR younger than 90 days

[nelsonab]

Tfqzab, be patient. Your second post was one minute after the first was posted, if you had more information that's good, but to imply a sense of urgency so quickly after you posted is not very polite.

Keul is correct in their statements about the trends vs actual data storage. When you view graphs of a period greater than a week the long term history table is used as a data source to generate the graphs. I also think you're seeing a scaling issue. There is too much data to pack into a graph and as such the data must be scaled appropriately. Each pixel will cover a large expanse of time and may also cover a wide array of data. As such extreme high and extreme low data points are likely to be missed unless when drawing the graph, hence why the data is also given in the table. Try viewing the graph one week at a time and you will likely see better data resolution. This is not a fault of Zabbix, but a problem for any graph.

[tfqzab]

Can't see the picture. Search for a better image host provider.

For each zabbix items, you can set history time (default : 90days) and the trend time( default : 356days)

Zabbix stores history in history tables (one table for each type of history : number, floating number, text...) witch can take a lot of space.

To get more data in history, zabbix converts raw data older than history time and younger than trend time to trend data (that include min/max/avg
for a set of multiple values) witch is less detailed but witch will tale less space in DB (like taking a thumbnail of a picture : you can store more thumbnails in one screen but you lose the details.

SO, when you will look at your graphs in the past/ zabbix will search in history AND / OR trend table depending if tour graph displays data older AND / OR younger than 90 days

Thanks, Keul. Sorry for my picture's lost.
I'll post a new picture tommorrow when I am at work. Hope you can see my following
explanation:
The picture mainly contains two parts:
one is a graph, x-the time, Y-the bits per second;
the other is the note below the grpah, like min 210kbps, avg 2.7Mbps, max 13.65Mbps
my problem is when I look up one day's data, it marked "max 13.65Mbps", but this value
is not drawn in the graph, where the highest point is only 7Mbps.

What's more, the day I mentioned up is younger than the history time, but I see no
searching words relevant to the history table in debug mode.

I set the history time to 31 days, but the mismatch of the graph and the marked data shows
up very frequently when I just look up 3 days' data or 1 week's data.

I attached the picture, it is not the same as the lost one that I post, and the datas are different, but the problem is the same, the marked max vlaue and the highest point drawn in the graph mismatch.

Thank you again for your kind-hearted help.

[keul]

Yes, that's strange.

Have you also the same bug when you display only one item graph value?

[tfqzab]

Tfqzab, be patient. Your second post was one minute after the first was posted, if you had more information that's good, but to imply a sense of urgency so quickly after you posted is not very polite.

Keul is correct in their statements about the trends vs actual data storage. When you view graphs of a period greater than a week the long term history table is used as a data source to generate the graphs. I also think you're seeing a scaling issue. There is too much data to pack into a graph and as such the data must be scaled appropriately. Each pixel will cover a large expanse of time and may also cover a wide array of data. As such extreme high and extreme low data points are likely to be missed unless when drawing the graph, hence why the data is also given in the table. Try viewing the graph one week at a time and you will likely see better data resolution. This is not a fault of Zabbix, but a problem for any graph.

Thanks, nelsonab. Sorry for my impatience.
I've replied to Keul just now. And I attached a new picture not
the exact previous one but with the same problem. I only look up
one day's data. I notcie the max vlaue is much greater than the min
value, so is it just because of scaling?
Thank you again!

[tfqzab]

Yes, that's strange.

Have you also the same bug when you display only one item graph value?

No, all my graphs include two items, the inOctets and outOctets. I tried your advice just now, but it does not work. I attached the graph, I also attached the graph properties settings. Maybe I made some mistakes somewhere.

Thanks.

[keul]

In function, try "all" instead of average.

I think that's what happens :
Max, min, avg and last are extracted from the values and display at bottom

avg values are calculated to draw the graph according to graph resolution/zoom.
Graph max/min and curv are drawn from this averages values.

If you zoom on a spike, you will maybe see the real max.

[tfqzab]

In function, try "all" instead of average.

I think that's what happens :
Max, min, avg and last are extracted from the values and display at bottom

avg values are calculated to draw the graph according to graph resolution/zoom.
Graph max/min and curv are drawn from this averages values.

If you zoom on a spike, you will maybe see the real max.

Thank you, Keul. I tried the "all" function, and I got it. Great!
You're right. avg values are calculated to draw the graph according to graph resolution/zoom.
And I want to say zabbix is quite powerful and amazing.

Many thanks.

[tfqzab]

How is the avg value calculated?

Maybe I need more help.
I set the item(InOctets.24) update interval to 15 seconds.
I know when I look up a period's data, the avg value is calculated according to zoom.
Now I watch 1 hour's data,--the min zoom, I find there sometimes the max value and the avg are still different, and there're min vlaues dfferent from them at some points. I counted the drawing points between tow time points -- 09:54 and 09:56, , it's extremly close to 8 if not exact 8. So I wonder how is the avg value at the time point 09:56 calculated? What're the source datas for
this avg vlaue?

[keul]

in RAM i think
YOu have to look at the source-code to know the parameters.