Quick ?s
Cheat Sheets
Man Pages
The Lynx
RRDTUTORIAL(1)			    rrdtool			RRDTUTORIAL(1)

       rrdtutorial - Alex van den Bogaerdts RRDtool tutorial

       RRDtool is written by Tobias Oetiker  with contribu
       tions from many people all around the world. This document is written
       by Alex van den Bogaerdt  to help you under
       stand what RRDtool is and what it can do for you.

       The documentation provided with RRDtool can be too technical for some
       people. This tutorial is here to help you understand the basics of RRD
       tool. It should prepare you to read the documentation yourself.	It
       also explains the general things about statistics with a focus on net


       Please dont skip ahead in this document!  The first part of this docu
       ment explains the basics and may be boring.  But if you dont under
       stand the basics, the examples will not be as meaningful to you.

       What is RRDtool?

       RRDtool refers to Round Robin Database tool.  Round robin is a tech
       nique that works with a fixed amount of data, and a pointer to the cur
       rent element. Think of a circle with some dots plotted on the edge --
       these dots are the places where data can be stored. Draw an arrow from
       the center of the circle to one of the dots -- this is the pointer.
       When the current data is read or written, the pointer moves to the next
       element. As we are on a circle there is neither a beginning nor an end,
       you can go on and on and on. After a while, all the available places
       will be used and the process automatically reuses old locations. This
       way, the dataset will not grow in size and therefore requires no main
       tenance.  RRDtool works with with Round Robin Databases (RRDs). It
       stores and retrieves data from them.

       What data can be put into an RRD?

       You name it, it will probably fit as long as it is some sort of time-
       series data. This means you have to be able to measure some value at
       several points in time and provide this information to RRDtool. If you
       can do this, RRDtool will be able to store it. The values must be
       numerical but dont have to be integers, as is the case with MRTG (the
       next section will give more details on this more specialized applica

       Many examples below talk about SNMP which is an acronym for Simple Net
       work Management Protocol. "Simple" refers to the protocol -- it does
       not mean it is simple to manage or monitor a network. After working
       your way through this document, you should know enough to be able to
       understand what people are talking about. For now, just realize that
       SNMP can be used to query devices for the values of counters they keep.
       It is the value from those counters that we want to store in the RRD.

       What can I do with this tool?

       RRDtool originated from MRTG (Multi Router Traffic Grapher). MRTG
       started as a tiny little script for graphing the use of a universitys
       connection to the Internet. MRTG was later (ab-)used as a tool for
       graphing other data sources including temperature, speed, voltage, num
       ber of printouts and the like.

       Most likely you will start to use RRDtool to store and process data
       collected via SNMP. The data will most likely be bytes (or bits) trans
       fered from and to a network or a computer.  But it can also be used to
       display tidal waves, solar radiation, power consumption, number of vis
       itors at an exhibition, noise levels near an airport, temperature on
       your favorite holiday location, temperature in the fridge and whatever
       you imagination can come up with.

       You only need a sensor to measure the data and be able to feed the num
       bers into RRDtool. RRDtool then lets you create a database, store data
       in it, retrieve that data and create graphs in PNG format for display
       on a web browser. Those PNG images are dependent on the data you col
       lected and could be, for instance, an overview of the average network
       usage, or the peaks that occurred.

       What if I still have problems after reading this document?

       First of all: read it again! You may have missed something.  If you are
       unable to compile the sources and you have a fairly common OS, it will
       probably not be the fault of RRDtool. There may be pre-compiled ver
       sions around on the Internet. If they come from trusted sources, get
       one of those.

       If on the other hand the program works but does not give you the
       expected results, it will be a problem with configuring it. Review your
       configuration and compare it with the examples that follow.

       There is a mailing list and an archive of it. Read the list for a few
       weeks and search the archive. It is considered rude to just ask a ques
       tion without searching the archives: your problem may already have been
       solved for somebody else!  This is true for most, if not all, mailing
       lists and not only for this particular one. Look in the documentation
       that came with RRDtool for the location and usage of the list.

       I suggest you take a moment to subscribe to the mailing list right now
       by sending an email to  with a sub
       ject of "subscribe". If you ever want to leave this list, just write an
       email to the same address but now with a subject of "unsubscribe".

       How will you help me?

       By giving you some detailed descriptions with detailed examples.  I
       assume that following the instructions in the order presented will give
       you enough knowledge of RRDtool to experiment for yourself.  If it
       doesnt work the first time, dont give up. Reread the stuff that you
       did understand, you may have missed something.

       By following the examples you get some hands-on experience and, even
       more important, some background information of how it works.

       You will need to know something about hexadecimal numbers. If you dont
       then start with reading bin_dec_hex before you continue here.

       Your first Round Robin Database

       In my opinion the best way to learn something is to actually do it.
       Why not start right now?  We will create a database, put some values in
       it and extract this data again.	Your output should be the same as the
       output that is included in this document.

       We will start with some easy stuff and compare a car with a router, or
       compare kilometers (miles if you wish) with bits and bytes. Its all
       the same: some number over some time.

       Assume we have a device that transfers bytes to and from the Internet.
       This device keeps a counter that starts at zero when it is turned on,
       increasing with every byte that is transfered. This counter will proba
       bly have a maximum value. If this value is reached and an extra byte is
       counted, the counter starts over at zero. This is the same as many
       counters in the world such as the mileage counter in a car.

       Most discussions about networking talk about bits per second so lets
       get used to that right away. Assume a byte is eight bits and start to
       think in bits not bytes. The counter, however, still counts bytes!  In
       the SNMP world most of the counters are 32 bits. That means they are
       counting from 0 to 4294967295. We will use these values in the exam
       ples.  The device, when asked, returns the current value of the
       counter. We know the time that has passes since we last asked so we now
       know how many bytes have been transfered ***on average*** per second.
       This is not very hard to calculate. First in words, then in calcula

       1. Take the current counter, subtract the previous value from it.

       2. Do the same with the current time and the previous time (in sec

       3. Divide the outcome of (1) by the outcome of (2), the result is the
	  amount of bytes per second. Multiply by eight to get the number of
	  bits per second (bps).

	 bps = (counter_now - counter_before) / (time_now - time_before) * 8

       For some people it may help to translate this to an automobile example.
       Do not try this example, and if you do, dont blame me for the results!

       People who are not used to think in kilometers per hour can translate
       most into miles per hour by dividing km by 1.6 (close enough).  I will
       use the following abbreviations:

	M:    meter
	KM:   kilometer (= 1000 meters).
	H:    hour
	S:    second
	KM/H: kilometers per hour
	M/S:  meters per second

       You are driving a car. At 12:05 you read the counter in the dashboard
       and it tells you that the car has moved 12345 KM until that moment.
       At 12:10 you look again, it reads 12357 KM. This means you have trav
       eled 12 KM in five minutes. A scientist would translate that into
       meters per second and this makes a nice comparison toward the problem
       of (bytes per five minutes) versus (bits per second).

       We traveled 12 kilometers which is 12000 meters. We did that in five
       minutes or 300 seconds. Our speed is 12000M / 300S or 40 M/S.

       We could also calculate the speed in KM/H: 12 times 5 minutes is an
       hour, so we have to multiply 12 KM by 12 to get 144 KM/H.  For our
       native English speaking friends: thats 90 MPH so dont try this exam
       ple at home or where I live :)

       Remember: these numbers are averages only.  There is no way to figure
       out from the numbers, if you drove at a constant speed.	There is an
       example later on in this tutorial that explains this.

       I hope you understand that there is no difference in calculating M/S or
       bps; only the way we collect the data is different. Even the K from
       kilo is the same as in networking terms k also means 1000.

       We will now create a database where we can keep all these interesting
       numbers. The method used to start the program may differ slightly from
       OS to OS, but I assume you can figure it out if it works different on
       yours. Make sure you do not overwrite any file on your system when
       executing the following command and type the whole line as one long
       line (I had to split it for readability) and skip all of the \ char

	  rrdtool create test.rrd	      \
		   --start 920804400	      \
		   DS:speed:COUNTER:600:U:U   \
		   RRA:AVERAGE:0.5:1:24       \

       (So enter: "rrdtool create test.rrd --start 920804400 DS ...")

       What has been created?

       We created the round robin database called test (test.rrd) which starts
       at noon the day I started writing this document, 7th of March, 1999
       (this date translates to 920804400 seconds as explained below). Our
       database holds one data source (DS) named "speed" that represents a
       counter. This counter is read every five minutes (default).  In the
       same database two round robin archives (RRAs) are kept, one averages
       the data every time it is read (e.g., theres nothing to average) and
       keeps 24 samples (24 times 5 minutes is 2 hours). The other averages 6
       values (half hour) and contains 10 such averages (e.g., 5 hours).

       RRDtool works with special time stamps coming from the UNIX world.
       This time stamp is the number of seconds that passed since January 1st
       1970 UTC.  The time stamp value is translated into local time and it
       will therefore look different for different time zones.

       Chances are that you are not in the same part of the world as I am.
       This means your time zone is different. In all examples where I talk
       about time, the hours may be wrong for you. This has little effect on
       the results of the examples, just correct the hours while reading.  As
       an example: where I will see "12:05" the UK folks will see "11:05".

       We now have to fill our database with some numbers. Well pretend to
       have read the following numbers:

	12:05  12345 KM
	12:10  12357 KM
	12:15  12363 KM
	12:20  12363 KM
	12:25  12363 KM
	12:30  12373 KM
	12:35  12383 KM
	12:40  12393 KM
	12:45  12399 KM
	12:50  12405 KM
	12:55  12411 KM
	13:00  12415 KM
	13:05  12420 KM
	13:10  12422 KM
	13:15  12423 KM

       We fill the database as follows:

	rrdtool update test.rrd 920804700:12345 920805000:12357 920805300:12363
	rrdtool update test.rrd 920805600:12363 920805900:12363 920806200:12373
	rrdtool update test.rrd 920806500:12383 920806800:12393 920807100:12399
	rrdtool update test.rrd 920807400:12405 920807700:12411 920808000:12415
	rrdtool update test.rrd 920808300:12420 920808600:12422 920808900:12423

       This reads: update our test database with the following numbers

	time 920804700, value 12345
	time 920805000, value 12357


       As you can see, it is possible to feed more than one value into the
       database in one command. I had to stop at three for readability but the
       real maximum per line is OS dependent.

       We can now retrieve the data from our database using "rrdtool fetch":

	rrdtool fetch test.rrd AVERAGE --start 920804400 --end 920809200

       It should return the following output:


	920804700: nan
	920805000: 4.0000000000e-02
	920805300: 2.0000000000e-02
	920805600: 0.0000000000e+00
	920805900: 0.0000000000e+00
	920806200: 3.3333333333e-02
	920806500: 3.3333333333e-02
	920806800: 3.3333333333e-02
	920807100: 2.0000000000e-02
	920807400: 2.0000000000e-02
	920807700: 2.0000000000e-02
	920808000: 1.3333333333e-02
	920808300: 1.6666666667e-02
	920808600: 6.6666666667e-03
	920808900: 3.3333333333e-03
	920809200: nan

       If it doesnt, something may be wrong.  Perhaps your OS will print
       "NaN" in a different form. "NaN" stands for "Not A Number".  If your OS
       writes "U" or "UNKN" or something similar thats okay.  If something
       else is wrong, it will probably be due to an error you made (assuming
       that my tutorial is correct of course :-). In that case: delete the
       database and try again.	Sometimes things change.  This example used to
       provide numbers like "0.04" in stead of "4.00000e-02".  Those are
       really the same numbers, just written down differently.	Dont be
       alarmed if a future version of rrdtool displays a slightly different
       form of output. The examples in this document are correct for version
       1.2.0 of RRDtool.

       The meaning of the above output will become clear below.

       Time to create some graphics

       Try the following command:

	rrdtool graph speed.png 				\
		--start 920804400 --end 920808000		\
		DEF:myspeed=test.rrd:speed:AVERAGE		\

       This will create speed.png which starts at 12:00 and ends at 13:00.
       There is a definition of a variable called myspeed, using the data from
       RRA "speed" out of database "test.rrd". The line drawn is 2 pixels high
       and represents the variable myspeed. The color is red (specified by its
       rgb-representation, see below).

       Youll notice that the start of the graph is not at 12:00 but at 12:05.
       This is because we have insufficient data to tell the average before
       that time. This will only happen when you miss some samples, this will
       not happen a lot, hopefully.

       If this has worked: congratulations! If not, check what went wrong.

       The colors are built up from red, green and blue. For each of the com
       ponents, you specify how much to use in hexadecimal where 00 means not
       included and FF means fully included.  The "color" white is a mixture
       of red, green and blue: FFFFFF The "color" black is all colors off:

	  red	  #FF0000
	  green   #00FF00
	  blue	  #0000FF
	  magenta #FF00FF     (mixed red with blue)
	  gray	  #555555     (one third of all components)

       Additionally you can add an alpha channel (transparency).  The default
       will be "FF" which means non-transparent.

       The PNG you just created can be displayed using your favorite image
       viewer.	Web browsers will display the PNG via the URL

       Graphics with some math

       When looking at the image, you notice that the horizontal axis is
       labeled 12:10, 12:20, 12:30, 12:40 and 12:50. Sometimes a label doesnt
       fit (12:00 and 13:00 would be candidates) so they are skipped.

       The vertical axis displays the range we entered. We provided kilometers
       and when divided by 300 seconds, we get very small numbers. To be
       exact, the first value was 12 (12357-12345) and divided by 300 this
       makes 0.04, which is displayed by RRDtool as "40 m" meaning "40/1000".
       The "m" (milli) has nothing to do with meters, kilometers or millime
       ters! RRDtool doesnt know about the physical units of our data, it
       just works with dimensionless numbers.

       If we had measured our distances in meters, this would have been
       (12357000-12345000)/300 = 12000/300 = 40.

       As most people have a better feel for numbers in this range, well cor
       rect that. We could recreate our database and store the correct data,
       but there is a better way: we do some calculations while creating the
       png file!

	  rrdtool graph speed2.png			     \
	     --start 920804400 --end 920808000		     \
	     --vertical-label m/s			     \
	     DEF:myspeed=test.rrd:speed:AVERAGE 	     \
	     CDEF:realspeed=myspeed,1000,\*		     \

       Note: Make sure not to forget the backslash \ in front of the multipli
       cation operator * above. The backslash is needed to "escape" the * as
       some operating systems might interpret and expand * instead of passing
       it to the rrdtool command.

       After viewing this PNG, you notice the "m" (milli) has disappeared.
       This it what the correct result would be. Also, a label has been added
       to the image.  Apart from the things mentioned above, the PNG should
       look the same.

       The calculations are specified in the CDEF part above and are in
       Reverse Polish Notation ("RPN"). What we requested RRDtool to do is:
       "take the data source myspeed and the number 1000; multiply those".
       Dont bother with RPN yet, it will be explained later on in more
       detail. Also, you may want to read my tutorial on CDEFs and Steve
       Raders tutorial on RPN. But first finish this tutorial.

       Hang on! If we can multiply values with 1000, it should also be possi
       ble to display kilometers per hour from the same data!

       To change a value that is measured in meters per second:

	Calculate meters per hour:     value * 3600
	Calculate kilometers per hour: value / 1000
	Together this makes:	       value * (3600/1000) or value * 3.6

       In our example database we made a mistake and we need to compensate for
       this by multiplying with 1000. Applying that correction:

	value * 3.6  * 1000 == value * 3600

       Now lets create this PNG, and add some more magic ...

	rrdtool graph speed3.png			     \
	     --start 920804400 --end 920808000		     \
	     --vertical-label km/h			     \
	     DEF:myspeed=test.rrd:speed:AVERAGE 	     \
	     "CDEF:kmh=myspeed,3600,*"			     \
	     CDEF:fast=kmh,100,GT,kmh,0,IF		     \
	     CDEF:good=kmh,100,GT,0,kmh,IF		     \
	     HRULE:100#0000FF:"Maximum allowed" 	     \
	     AREA:good#00FF00:"Good speed"		     \
	     AREA:fast#FF0000:"Too fast"

       Note: here we use another means to escape the * operator by enclosing
       the whole string in double quotes.

       This graph looks much better. Speed is shown in KM/H and there is even
       an extra line with the maximum allowed speed (on the road I travel on).
       I also changed the colors used to display speed and changed it from a
       line into an area.

       The calculations are more complex now. For speed measurements within
       the speed limit they are:

	  Check if kmh is greater than 100    ( kmh,100 ) GT
	  If so, return 0, else kmh	      ((( kmh,100 ) GT ), 0, kmh) IF

       For values above the speed limit:

	  Check if kmh is greater than 100    ( kmh,100 ) GT
	  If so, return kmh, else return 0    ((( kmh,100) GT ), kmh, 0) IF

       Graphics Magic

       I like to believe there are virtually no limits to how RRDtool graph
       can manipulate data. I will not explain how it works, but look at the
       following PNG:

	  rrdtool graph speed4.png			     \
	     --start 920804400 --end 920808000		     \
	     --vertical-label km/h			     \
	     DEF:myspeed=test.rrd:speed:AVERAGE 	     \
	     "CDEF:kmh=myspeed,3600,*"			     \
	     CDEF:fast=kmh,100,GT,100,0,IF		     \
	     CDEF:over=kmh,100,GT,kmh,100,-,0,IF	     \
	     CDEF:good=kmh,100,GT,0,kmh,IF		     \
	     HRULE:100#0000FF:"Maximum allowed" 	     \
	     AREA:good#00FF00:"Good speed"		     \
	     AREA:fast#550000:"Too fast"		     \
	     STACK:over#FF0000:"Over speed"

       Lets create a quick and dirty HTML page to view the three PNGs:

	  Speed in meters per second
Speed in kilometers per hour
Traveled too fast? Name the file "speed.html" or similar, and look at it in your web browser. Now, all you have to do is measure the values regularly and update the database. When you want to view the data, recreate the PNGs and make sure to refresh them in your browser. (Note: just clicking reload may not be enough, especially when proxies are involved. Try shift-reload or ctrl-F5). Updates in Reality Weve already used the "update" command: it took one or more parameters in the form of "

Yals.net is © 1999-2009 Crescendo Communications
Sharing tech info on the web for more than a decade!
This page was generated Thu Apr 30 17:05:22 2009