How do I generate predictive Values for network interface bandwith without setting limits?

General
,
1

Hi all,

we want to activate generation of predictive Values for bandwith, without set a initial Limit. I wanted to get the calculation done to have a view into the values before setting limits, but whenever I remove the limits from the Rule it stops generating the prediction.

image
image769×613 24.2 KB

Also setting relative Values to 101% doesn’t help as this still checks this and therfore generates WARN/CRIT States on interfaces. Any clues what I can do?

Kind Regards,

Andreas

2

Hi @Andreas-H,

This is a design constraint in Checkmk’s Predictive Levels: prediction and limits are tightly coupled — Checkmk only calculates the predictive baseline when it has somewhere to apply it (i.e. active limits). Without limits, the prediction engine simply doesn’t run.

Best approach for your goal:

Since you are on Enterprise Edition, use the built-in Forecast Graph first — no limits needed. Open the interface service → its In/Out traffic graph → click the graph options → “Show forecast”. This overlays a statistical prediction on the existing RRD data and lets you see what Checkmk would predict, completely independently of any alerting configuration.

Once you’ve observed the forecasts for a few weeks and have a feel for normal peaks:

  1. Activate Predictive Levels with very generous initial limits (e.g. WARN: +300%, CRIT: +500% of predicted value) — these won’t fire in practice, but they start the baseline building
  2. After 2–4 weeks of data, tighten the limits to sensible values based on what you observed

Setting 101% as you tried is actually tighter than expected traffic, not looser, which is why you get WARN/CRIT immediately. For a “don’t alert yet” phase you need values far above realistic peaks.

If you want to completely suppress alerting during the warm-up phase while still running the prediction, you can add a temporary rule under Setup → Services → Status of a service → force OK scoped to the relevant interface checks — then remove it after the observation period.

Happy monitoring …
Bernd