big spell checking patch -- slif@bellsouth.net

[rrdtool.git] / doc / rrdfetch.pod

=head1 NAME

rrdtool fetch - fetch data from an RRD.

=for html <div align="right"><a href="rrdfetch.pdf">PDF</a> version.</div>

=head1 SYNOPSIS

B<rrdtool> B<fetch> I<filename> I<CF> 
S<[B<--resolution>|B<-r> I<resolution>]> 
S<[B<--start>|B<-s> I<start>]> 
S<[B<--end>|B<-e> I<end>]> 

=head1 DESCRIPTION

The B<fetch> function is normally used internally by the graph function,
to get data from B<RRD>s. B<fetch> will analyze the B<RRD> and
will try to retrieve the data in the resolution requested.
The data fetched is printed to stdout. I<*UNKNOWN*> data is often
represented by the string "NaN" depending on your OS's printf
function.

=over 8

=item I<filename> 

the name of the B<RRD> you want to fetch the data from.

=item I<CF> 

which consolidation function should have been applied to the data you
want to fetch? (AVERAGE,MIN,MAX,LAST)

=item B<--resolution>|B<-r> I<resolution> (default is the highest resolution)

what interval should the values have (seconds per value). B<rrdfetch> will try
to match your request, but it will return data even if no absolute
match is possible. B<NB.> See note below.

=item B<--start>|B<-s> I<start> (default end-1day)

when should the data begin. A time in seconds since epoch (1970-01-01)
is required. Negative numbers are relative to the current time. By default
one day worth of data will be fetched. See also AT-STYLE TIME SPECIFICATION
section for a detailed explanation on  ways to specify start time.

=item B<--end>|B<-e> I<end> (default now)

when should the data end. Time in seconds since epoch. See also
AT-STYLE TIME SPECIFICATION section for a detailed explanation of how to specify
end time.

=back

=head2 RESOLUTION INTERVAL

In order to get RRDtool to fetch anything other than the finest resolution RRA 
B<both> the start and end time must be specified on boundaries that are 
multiples of the wanted resolution. Consider the following example:

 rrdtool create subdata.rrd -s 10 DS:ds0:GAUGE:300:0:U \
  RRA:AVERAGE:0.5:30:3600 \
  RRA:AVERAGE:0.5:90:1200 \
  RRA:AVERAGE:0.5:360:1200 \
  RRA:MAX:0.5:360:1200 \
  RRA:AVERAGE:0.5:8640:600 \
  RRA:MAX:0.5:8640:600

This RRD collects data every 10 seconds and stores its averages over 5 minutes, 
15 minutes, 1 hour and 1 day as well as the maxima for 1 hour and 1 day.

Consider now that you want too fetch the 15 minute average data for last hour. 
So you might try

 rrdtool fetch subdata.rrd AVERAGE -r 900 -s -1h

However, this will almost always result in a time series that is B<NOT> in the 15 
minute RRA. Therefore the highest resolution RRA, i.e. 5 minute averages, will 
be chosen which, in this case, is not what you want.

Hence, make sure that

=over 3

=item 1.

both start and end time are a multiple of 900

=item 2.

both start and end time are within the wanted RRA

=back

So, if time now is called "t",

 do end time == int(t/900)*900,
 start time == end time -1hour, resolution == 900.

In e.g. bash this could look as:

 TIME=$(date +%s); RRDRES=900; rrdtool fetch subdata.rrd AVERAGE -r $RRDRES \
 -e $(echo $(($TIME/$RRDRES*$RRDRES))) -s e-1h

Or in Perl:

 perl -e '$ctime = time; $rrdres = 900; system "rrdtool fetch subdata.rrd AVERAGE \
 -r $rrdres -e @{[int($ctime/$rrdres)*$rrdres]} -s e-1h"'


=head2 AT-STYLE TIME SPECIFICATION

Apart from the traditional I<Seconds since epoch>, RRDtool does also
understand at-style time specification.  The specification is called
"at-style" after Unix command at(1) that has moderately complex ways
to specify time to run your job at.  The at-style specification
consists of two parts: B<TIME REFERENCE> specification and B<TIME
OFFSET> specification.

=head2 TIME REFERENCE SPECIFICATION

Time reference specification is used, well,... to establish a reference
moment in time (for time offset to be applied to). When present,
it should come first, when omitted, it defaults to B<now>. On its own part,
time reference consists of I<time-of-day> reference (which should come
first, if present) and I<day> reference.

I<Time-of-day> can be specified as B<HH:MM>, B<HH.MM>,
or just B<HH>, you can suffix it with B<am> or B<pm> or use
24-hours clock. The few special times of day are understood as well,
these include B<midnight> (00:00), B<noon> (12:00) and British
B<teatime> (16:00).

The I<day> can be specified as I<month-name> I<day-of-the-month>
and optional 2- or 4-digit I<year> number (e.g. March 8 1999).
Alternatively, you can use I<day-of-week-name> (e.g. Monday),
or one of the words: B<yesterday>, B<today>, B<tomorrow>.
You can also specify I<day> as a full date in several numerical formats;
these include: B<MM/DD/[YY]YY>, B<DD.MM.[YY]YY>, B<YYYYMMDD>.

I<NOTE1>: this is different from the original at(1) behavior,
which interprets a single-number date as MMDD[YY]YY.

I<NOTE2>: if you specify I<day> this way, the I<time-of-day> is REQUIRED
to be present.

Finally, you can use words B<now>, B<start>, or B<end> as your time
reference. B<Now> refers to the current moment (and is also a default
time reference). B<Start> (B<end>) can be used to specify time
relative to the start (end) time for those tools that use these
categories (B<rrdfetch>, L<rrdgraph>).

Month and weekday names can be used in their naturally abbreviated form
(e.g., Dec for December, Sun for Sunday, etc.). The words B<now>,
B<start>, B<end> can be abbreviated to B<n>, B<s>, B<e>.

=head2 TIME OFFSET SPECIFICATION

Time offset specification is used to add (or subtract) certain time
interval to (from) the time reference moment. It consists of I<sign>
(S<B<+> or B<->>) and I<amount>. The following time units can be used
to specify the I<amount>: B<years>, B<months>, B<weeks>, B<days>,
B<hours>, B<minutes>, B<seconds>, these can be used in singular
or plural form, and abbreviated naturally or to a single letter
(e.g. +3days, -1wk, -3y). Several time units can be combined
together (e.g., -5mon1w2d), as well as several time offsets can be
concatenated (e.g., -5h45min = -5h-45min = -6h+15min = -7h+1h30m-15min, etc.)

I<NOTE3>: If you specify time offset in days, weeks, months, or years,
you will end with the time offset that may vary depending on you time
reference, because all those time units have no single well defined
time interval value (S<1 year> contains either 365 or 366 days, S<1 month>
is 28 to 31 days long, and even S<1 day> may be not equal to 24 hours
twice a year, when DST-related clock adjustments take place).
To cope with this, when you use days, weeks, months, or years
as your time offset units your time reference date is adjusted
accordingly without taking too much further effort to ensure anything
about it (in the hope that mktime(3) will take care of this later).
This may lead to some surprising (or even invalid!) results,
e.g. S<'May 31 -1month'> = S<'Apr 31'> (meaningless) = S<'May 1'>
(after mktime(3) normalization); in the EET timezone
'3:30am Mar 29 1999 -1 day' yields '3:30am Mar 28 1999' (Sunday)
which is invalid time/date combination (because of 3am -> 4am DST
forward clock adjustment, see the below example).
On the other hand, hours, minutes, and seconds are well defined time
intervals, and these are guaranteed to always produce time offsets
exactly as specified (e.g. for EET timezone, S<'8:00 Mar 27 1999 +2 days'> =
S<'8:00 Mar 29 1999'>, but since there is 1-hour DST forward clock adjustment
takes place around S<3:00 Mar 28 1999>, the actual time interval between
S<8:00 Mar 27 1999> and S<8:00 Mar 29 1999> equals 47 hours; on the other hand,
S<'8:00 Mar 27 1999 +48 hours'> = S<'9:00 Mar 29 1999'>, as expected)

I<NOTE4>: The single-letter abbreviation for both B<months> and B<minutes>
is B<m>. To disambiguate, the parser tries to read your S<mind :)>
by applying the following two heuristics:

=over 3

=item 1

If B<m> is used in context of (i.e. right after the) years,
months, weeks, or days it is assumed to mean B<months>, while
in the context of hours, minutes, and seconds it means minutes.
(e.g., in -1y6m or +3w1m B<m> means B<months>, while in
-3h20m or +5s2m B<m> means B<minutes>)

=item 2

Out of context (i.e. right after the B<+> or B<-> sign) the
meaning of B<m> is guessed from the number it directly follows.
Currently, if the number absolute value is below 25 it is assumed
that B<m> means B<months>, otherwise it is treated as B<minutes>.
(e.g., -25m == -25 minutes, while +24m == +24 months)

=back

I<Final NOTES>: Time specification is case-insensitive.
Whitespace can be inserted freely or omitted altogether,
there are, however, cases when whitespace is required
(e.g., S<'midnight Thu'>). In this case you should either quote the
whole phrase to prevent it from being taken apart by your shell or use
'_' (underscore) or ',' (comma) which also count as whitespace
(e.g., midnight_Thu or midnight,Thu)


=head2 TIME SPECIFICATION EXAMPLES

I<Oct 12> -- October 12 this year

I<-1month> or I<-1m> -- current time of day, only a month before
(may yield surprises, see the NOTE3 above)

I<noon yesterday -3hours> -- yesterday morning; can be put also as I<9am-1day>

I<23:59 31.12.1999> -- 1 minute to the year 2000

I<12/31/99 11:59pm> -- 1 minute to the year 2000 for imperialists

I<12am 01/01/01> -- start of the new millennium

I<end-3weeks> or I<e-3w> -- 3 weeks before end time
(may be used as start time specification)

I<start+6hours> or I<s+6h> -- 6 hours after start time
(may be used as end time specification)

I<931225537> -- 18:45  July 5th, 1999
(yes, seconds since 1970 are valid as well)

I<19970703 12:45> -- 12:45  July 3th, 1997
(my favorite, and its even got an ISO number (8601))

=head1 AUTHOR

Tobias Oetiker <oetiker@ee.ethz.ch>