The principle of an RRD file is shown in the next figure. We have defined three Round Robin Archives—one storing 5 minute polling data, one storing 20 minutes (4 * 5 minute polling data) aggregated data, and another storing hourly (12 * 5 minute polling data) aggregated data.

In this example, the data step is defined as 5 minutes (300 seconds) so updates to the RRD file should happen every 5 minutes. During each update, the data is being written to the first archive. After 20 minutes have passed, the first data set is aggregated and written to the second archive so that it contains an overall view of the 20-minute period. Once a full hour has passed, the first data set is once again aggregated and written to the hourly archive, providing a broader view.

Each RRA is limited to a specific amount of data points, after which the data that has been written first will be overwritten by the newest data. This methodology ensures that the RRD files do not grow in size beyond their initial state. The disadvantage of this is the loss of detailed data once the RRA overwrites it:

Let's take the example and look at the corresponding rrdtool command:

rrdtool create test.rrd --step 300 \
DS:data:GAUGE:600:U:U            \
RRA:AVERAGE:0.5:1:16               \
RRA:AVERAGE:0.5:4:16               \
RRA:AVERAGE:0.5:12:16

The --step flag sets the heartbeat in which data is supposed to come in. In the example it is 5 minutes (300 seconds), which is the default for RRD files. This file contains one data source (DS) called data, which is defined as a gauge. Since we don't want to limit the data entering the archive based on a minimum or maximum value, it is set to U. The 600 defined here is the time in seconds allowed to pass between two updates before the specific data point is set to unknown.

The file contains three round RRAs. The first one stores 16 data points, so a total of 80 minutes of data is stored.

The second archive stores 16 data points, which are each an aggregated average of the last four data polls. This gives a total amount of 320 minutes, or five hours. This also means that this archive has already lost some detailed information as each data point in it only represents a 20-minute timeslot, but we can view data going much further back.

The last archive also contains 16 data points, but this time one data point is an aggregated average of the last 12 polls. Therefore, each data point in the archive represents one whole hour, but allows us to keep data from 16 hours earlier.

As can be seen in this example, if you go beyond the previous 80 minutes, you will lose the data granularity, as aggregation kicks in.

The default RRA definitions of Cacti are:

As the default polling interval for Cacti is five minutes, the daily data will have the most detailed data. Unfortunately, the Daily 5-minute Average RRA will only keep this detailed data for 2 days, after which you will lose the detailed information. This can be changed in Cacti, but will also increase the RRD file size significantly.

There are many more options available during the RRD file creation. If you are interested in learning more, you will find some links and references in the previous appendix.