X-Git-Url: https://git.octo.it/?p=rrdtool.git;a=blobdiff_plain;f=doc%2Frrdgraph_examples.pod;h=5821438cd417d5e804ef0e9a1bc90ce85f795ba8;hp=64e38404e5bf057a2b2054dbd767fe575a487d05;hb=b69a1a9abc9afdc2bfb23b84e28c2afb0b1a5e09;hpb=dbe71bcd8b2e23ce0becaf5e51e22fdd40ae4fad

diff --git a/doc/rrdgraph_examples.pod b/doc/rrdgraph_examples.pod
index 64e3840..5821438 100644
--- a/doc/rrdgraph_examples.pod
+++ b/doc/rrdgraph_examples.pod
@@ -70,7 +70,7 @@ Note: the column titles have to be as wide as the columns
 
 Depending on your needs you can do this in two ways:
 
-=over 4
+=over
 
 =item *
 
@@ -99,6 +99,24 @@ Note: the second line gets stacked on top of the first one
 
 =back
 
+=head2 Drawing dashed lines
+
+Also works for HRULE and VRULE
+
+=over
+
+=item *
+
+default style: - - - - -
+    LINE1:data#FF0000:"dashed line":dashes
+
+=item *
+
+more fancy style with offset: - -  --- -  --- -
+    LINE1:data#FF0000:"another dashed line":dashes=15,5,5,10:dash-offset=10
+
+=back
+
 =head2 Time ranges
 
     Last four weeks: --start end-4w --end 00:00
@@ -121,6 +139,62 @@ Shift the data forward by one week (604800 seconds)
     AREA:lastweek#0000FF:Last\ week
     LINE1:thisweek#FF0000:This\ week
 
+=head2 Aberrant Behaviour Detection
+
+If the specialized function B<RRAs> exist for aberrant behavior detection, they
+can be used to generate the graph of a time series with confidence bands and
+failures.
+
+   rrdtool graph example.png \
+          DEF:obs=monitor.rrd:ifOutOctets:AVERAGE \
+          DEF:pred=monitor.rrd:ifOutOctets:HWPREDICT \
+          DEF:dev=monitor.rrd:ifOutOctets:DEVPREDICT \
+          DEF:fail=monitor.rrd:ifOutOctets:FAILURES \
+          TICK:fail#ffffa0:1.0:"Failures\: Average bits out" \
+          CDEF:scaledobs=obs,8,* \
+          CDEF:upper=pred,dev,2,*,+ \
+          CDEF:lower=pred,dev,2,*,- \
+          CDEF:scaledupper=upper,8,* \
+          CDEF:scaledlower=lower,8,* \
+          LINE2:scaledobs#0000ff:"Average bits out" \
+          LINE1:scaledupper#ff0000:"Upper Confidence Bound: Average bits out" \
+          LINE1:scaledlower#ff0000:"Lower Confidence Bound: Average bits out"
+
+This example generates a graph of the data series in blue (LINE2 with the scaledobs
+virtual data source), confidence bounds in red (scaledupper and scaledlower virtual
+data sources), and potential failures (i.e. potential aberrant aberrant behavior)
+marked by vertical yellow lines (the fail data source).
+
+The raw data comes from an AVERAGE B<RRA>, the finest resolution of the observed
+time series (one consolidated data point per primary data point). The predicted
+(or smoothed) values are stored in the HWPREDICT B<RRA>. The predicted deviations
+(think standard deviation) values are stored in the DEVPREDICT B<RRA>. Finally,
+the FAILURES B<RRA> contains indicators, with 1 denoting a potential failure.
+
+All of the data is rescaled to bits (instead of Octets) by multiplying by 8.
+The confidence bounds are computed by an offset of 2 deviations both above
+and below the predicted values (the CDEFs upper and lower). Vertical lines
+indicated potential failures are graphed via the TICK graph element, which
+converts non-zero values in an B<RRA> into tick marks. Here an axis-fraction
+argument of 1.0 means the tick marks span the entire y-axis, and hence become
+vertical lines on the graph.
+
+The choice of 2 deviations (a scaling factor) matches the default used internally
+by the FAILURES B<RRA>. If the internal value is changed (see L<rrdtune>), this
+graphing command should be changed to be consistent.
+
+=head3 A note on data reduction:
+
+The B<rrdtool> I<graph> command is designed to plot data at a specified temporal
+resolution, regardless of the actually resolution of the data in the RRD file.
+This can present a problem for the specialized consolidation functions which
+maintain a one-to-one mapping between primary data points and consolidated
+data points. If a graph insists on viewing the contents of these B<RRAs> on a
+coarser temporal scale, the I<graph> command tries to do something intelligent,
+but the confidence bands and failures no longer have the same meaning and may
+be misleading.
+
+
 =head1 SEE ALSO
 
 L<rrdgraph> gives an overview of how B<rrdtool graph> works.
@@ -128,8 +202,6 @@ L<rrdgraph_data> describes B<DEF>,B<CDEF> and B<VDEF> in detail.
 L<rrdgraph_rpn> describes the B<RPN> language used in the B<xDEF> statements.
 L<rrdgraph_graph> page describes all the graph and print functions.
 
-Make sure to read L<rrdgraph_examples> for tipsE<amp>tricks.
-
 =head1 AUTHOR
 
 Program by Tobias Oetiker E<lt>tobi@oetiker.chE<gt>