Bottom line: Keep the graph’s data selection with the incident record. Before comparing two averages, establish whether the same dataset, resolution and time interval produced them, then inspect the values behind the view.
\nThe OPNsense System Health guide describes a dynamic view of RRD data under Reporting Health. The primary-dataset control selects an RRD dataset, and the guide says datasets farther left have lower maximum resolution. The resolution control sets the maximum plotted data points and indirectly influences the scale of calculated averages. Zoom selection updates the main graph and tables, while the detailed table can export plotted values as CSV.
\nThe graph controls do not identify the cause of an incident or establish that the chosen series represents an application’s experience. DSE uses this article to preserve the interpretation of a selected view. Collection gaps, metric definitions and independent service observations need their own assessment.
\nThe following steps are DSE recommendations based on the cited source.
\nDSE recommends starting an incident comparison with a short graph record: device, metric, units, primary dataset, resolution, selected labels and interval. Preserve the view before adjusting it. Put the complaint or operational event on the same timeline, but leave the cause unresolved until the observations justify a narrower conclusion.
\nUse a proposed exercise with one quiet interval and one known authorized workload interval. Compare the same interval at two reviewed display resolutions and retain the settings beside each result. Ask the reviewer to explain any difference in the plotted average using the selected view and underlying values, rather than declaring one screenshot to be the correct account without that context.
\nExport the detailed values for the final incident interval where useful. Keep the export and screenshot together under an evidence identifier and document any manual calculation used in the report. If a needed historical view is unavailable, record that limitation directly. Avoid filling the gap with an unlabeled interpolation or substituting a different metric simply because it produces a complete-looking chart.
\nHave the report identify the selected units and plotted series next to the exported values. Preserve a version of the view before hiding any series for readability. Record the reason for a display change without treating that edit as new measurement evidence.
\nProposed verification: have a second operator recreate the chosen graph from the recorded controls and time interval. Compare the displayed table with the retained CSV and independently check a small selected group of values. Record what was actually available at that resolution, including missing or unexplained observations.
\nRepeat the comparison for the proposed workload interval without changing the interpretation rules midstream. Preserve the final evidence record with timestamps and the incident question it answers. Keep any additional application or packet measurements separately labeled, then explain how they relate. A reviewer should be able to distinguish a display-setting difference from a measured change in the selected series.
\nSource review completed October 28, 2026. Recheck the official documentation and deployment-specific applicability before a production change.
\n", "content_text": "Bottom line: Keep the graph’s data selection with the incident record. Before comparing two averages, establish whether the same dataset, resolution and time interval produced them, then inspect the values behind the view.\nSource fact: what the authority says\nThe OPNsense System Health guide describes a dynamic view of RRD data under Reporting Health. The primary-dataset control selects an RRD dataset, and the guide says datasets farther left have lower maximum resolution. The resolution control sets the maximum plotted data points and indirectly influences the scale of calculated averages. Zoom selection updates the main graph and tables, while the detailed table can export plotted values as CSV.\nWhat the source does not establish\nThe graph controls do not identify the cause of an incident or establish that the chosen series represents an application’s experience. DSE uses this article to preserve the interpretation of a selected view. Collection gaps, metric definitions and independent service observations need their own assessment.\nApplicability questions\n\nWhich category and graph address the incident question?\nWhat RRD dataset, resolution and selected interval produced the image or average?\nAre the visible labels and units the intended ones, including any hidden series?\nCan another operator reproduce the view and retrieve its detailed values?\n\nDSE recommendation: controlled next steps\nThe following steps are DSE recommendations based on the cited source.\nDSE recommends starting an incident comparison with a short graph record: device, metric, units, primary dataset, resolution, selected labels and interval. Preserve the view before adjusting it. Put the complaint or operational event on the same timeline, but leave the cause unresolved until the observations justify a narrower conclusion.\nUse a proposed exercise with one quiet interval and one known authorized workload interval. Compare the same interval at two reviewed display resolutions and retain the settings beside each result. Ask the reviewer to explain any difference in the plotted average using the selected view and underlying values, rather than declaring one screenshot to be the correct account without that context.\nExport the detailed values for the final incident interval where useful. Keep the export and screenshot together under an evidence identifier and document any manual calculation used in the report. If a needed historical view is unavailable, record that limitation directly. Avoid filling the gap with an unlabeled interpolation or substituting a different metric simply because it produces a complete-looking chart.\nHave the report identify the selected units and plotted series next to the exported values. Preserve a version of the view before hiding any series for readability. Record the reason for a display change without treating that edit as new measurement evidence.\nVerification and evidence\nProposed verification: have a second operator recreate the chosen graph from the recorded controls and time interval. Compare the displayed table with the retained CSV and independently check a small selected group of values. Record what was actually available at that resolution, including missing or unexplained observations.\nRepeat the comparison for the proposed workload interval without changing the interpretation rules midstream. Preserve the final evidence record with timestamps and the incident question it answers. Keep any additional application or packet measurements separately labeled, then explain how they relate. A reviewer should be able to distinguish a display-setting difference from a measured change in the selected series.\nOfficial references\n\nOPNsense — System Health & Round Robin Data — official product documentation; confirm the installed release and configuration.\n\nSource review completed October 28, 2026. Recheck the official documentation and deployment-specific applicability before a production change.", "content_markdown": "Bottom line: Keep the graph’s data selection with the incident record. Before comparing two averages, establish whether the same dataset, resolution and time interval produced them, then inspect the values behind the view.\n\n## Source fact: what the authority says\n\nThe [OPNsense System Health guide](https://docs.opnsense.org/manual/systemhealth.html) describes a dynamic view of RRD data under Reporting Health. The primary-dataset control selects an RRD dataset, and the guide says datasets farther left have lower maximum resolution. The resolution control sets the maximum plotted data points and indirectly influences the scale of calculated averages. Zoom selection updates the main graph and tables, while the detailed table can export plotted values as CSV.\n\n## What the source does not establish\n\nThe graph controls do not identify the cause of an incident or establish that the chosen series represents an application’s experience. DSE uses this article to preserve the interpretation of a selected view. Collection gaps, metric definitions and independent service observations need their own assessment.\n\n## Applicability questions\n\n- Which category and graph address the incident question?\n\n- What RRD dataset, resolution and selected interval produced the image or average?\n\n- Are the visible labels and units the intended ones, including any hidden series?\n\n- Can another operator reproduce the view and retrieve its detailed values?\n\n## DSE recommendation: controlled next steps\n\nThe following steps are DSE recommendations based on the cited source.\n\nDSE recommends starting an incident comparison with a short graph record: device, metric, units, primary dataset, resolution, selected labels and interval. Preserve the view before adjusting it. Put the complaint or operational event on the same timeline, but leave the cause unresolved until the observations justify a narrower conclusion.\n\nUse a proposed exercise with one quiet interval and one known authorized workload interval. Compare the same interval at two reviewed display resolutions and retain the settings beside each result. Ask the reviewer to explain any difference in the plotted average using the selected view and underlying values, rather than declaring one screenshot to be the correct account without that context.\n\nExport the detailed values for the final incident interval where useful. Keep the export and screenshot together under an evidence identifier and document any manual calculation used in the report. If a needed historical view is unavailable, record that limitation directly. Avoid filling the gap with an unlabeled interpolation or substituting a different metric simply because it produces a complete-looking chart.\n\nHave the report identify the selected units and plotted series next to the exported values. Preserve a version of the view before hiding any series for readability. Record the reason for a display change without treating that edit as new measurement evidence.\n\n## Verification and evidence\n\nProposed verification: have a second operator recreate the chosen graph from the recorded controls and time interval. Compare the displayed table with the retained CSV and independently check a small selected group of values. Record what was actually available at that resolution, including missing or unexplained observations.\n\nRepeat the comparison for the proposed workload interval without changing the interpretation rules midstream. Preserve the final evidence record with timestamps and the incident question it answers. Keep any additional application or packet measurements separately labeled, then explain how they relate. A reviewer should be able to distinguish a display-setting difference from a measured change in the selected series.\n\n## Official references\n\n- [OPNsense — System Health & Round Robin Data](https://docs.opnsense.org/manual/systemhealth.html) — official product documentation; confirm the installed release and configuration.\n\nSource review completed October 28, 2026. Recheck the official documentation and deployment-specific applicability before a production change." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/keep-opnsense-rrd-resolution-with-the-incident-evidence/", "url": "https://update.dsesecurity.com/updates/keep-opnsense-rrd-resolution-with-the-incident-evidence/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-28" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/keep-opnsense-rrd-resolution-with-the-incident-evidence/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "IT", "item": "https://update.dsesecurity.com/topic/it/" }, { "@type": "ListItem", "position": 3, "name": "Keep OPNsense RRD resolution with the incident evidence", "item": "https://update.dsesecurity.com/updates/keep-opnsense-rrd-resolution-with-the-incident-evidence/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/keep-opnsense-rrd-resolution-with-the-incident-evidence/#article", "identifier": "https://update.dsesecurity.com/updates/keep-opnsense-rrd-resolution-with-the-incident-evidence/", "url": "https://update.dsesecurity.com/updates/keep-opnsense-rrd-resolution-with-the-incident-evidence/", "headline": "Keep OPNsense RRD resolution with the incident evidence", "description": "OPNsense System Health uses RRD datasets and display resolution that influence graph averages; preserve those choices with incident exports.", "abstract": "OPNsense System Health uses RRD datasets and display resolution that influence graph averages; preserve those choices with incident exports.", "articleBody": "Bottom line: Keep the graph’s data selection with the incident record. Before comparing two averages, establish whether the same dataset, resolution and time interval produced them, then inspect the values behind the view.\nSource fact: what the authority says\nThe OPNsense System Health guide describes a dynamic view of RRD data under Reporting Health. The primary-dataset control selects an RRD dataset, and the guide says datasets farther left have lower maximum resolution. The resolution control sets the maximum plotted data points and indirectly influences the scale of calculated averages. Zoom selection updates the main graph and tables, while the detailed table can export plotted values as CSV.\nWhat the source does not establish\nThe graph controls do not identify the cause of an incident or establish that the chosen series represents an application’s experience. DSE uses this article to preserve the interpretation of a selected view. Collection gaps, metric definitions and independent service observations need their own assessment.\nApplicability questions\n\nWhich category and graph address the incident question?\nWhat RRD dataset, resolution and selected interval produced the image or average?\nAre the visible labels and units the intended ones, including any hidden series?\nCan another operator reproduce the view and retrieve its detailed values?\n\nDSE recommendation: controlled next steps\nThe following steps are DSE recommendations based on the cited source.\nDSE recommends starting an incident comparison with a short graph record: device, metric, units, primary dataset, resolution, selected labels and interval. Preserve the view before adjusting it. Put the complaint or operational event on the same timeline, but leave the cause unresolved until the observations justify a narrower conclusion.\nUse a proposed exercise with one quiet interval and one known authorized workload interval. Compare the same interval at two reviewed display resolutions and retain the settings beside each result. Ask the reviewer to explain any difference in the plotted average using the selected view and underlying values, rather than declaring one screenshot to be the correct account without that context.\nExport the detailed values for the final incident interval where useful. Keep the export and screenshot together under an evidence identifier and document any manual calculation used in the report. If a needed historical view is unavailable, record that limitation directly. Avoid filling the gap with an unlabeled interpolation or substituting a different metric simply because it produces a complete-looking chart.\nHave the report identify the selected units and plotted series next to the exported values. Preserve a version of the view before hiding any series for readability. Record the reason for a display change without treating that edit as new measurement evidence.\nVerification and evidence\nProposed verification: have a second operator recreate the chosen graph from the recorded controls and time interval. Compare the displayed table with the retained CSV and independently check a small selected group of values. Record what was actually available at that resolution, including missing or unexplained observations.\nRepeat the comparison for the proposed workload interval without changing the interpretation rules midstream. Preserve the final evidence record with timestamps and the incident question it answers. Keep any additional application or packet measurements separately labeled, then explain how they relate. A reviewer should be able to distinguish a display-setting difference from a measured change in the selected series.\nOfficial references\n\nOPNsense — System Health & Round Robin Data — official product documentation; confirm the installed release and configuration.\n\nSource review completed October 28, 2026. Recheck the official documentation and deployment-specific applicability before a production change.", "datePublished": "2026-10-29T00:10:07+00:00", "dateModified": "2026-10-29T00:10:35+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/keep-opnsense-rrd-resolution-with-the-incident-evidence/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/keep-opnsense-rrd-resolution-with-the-incident-evidence/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Keep OPNsense RRD resolution with the incident evidence" }, "articleSection": [ "IT", "Networks & Infrastructure" ], "keywords": [ "IT", "Networks & Infrastructure", "Guide", "Advisory priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 577, "timeRequired": "PT3M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "OPNsense — System Health & Round Robin Data", "url": "https://docs.opnsense.org/manual/systemhealth.html" } } ] } }