down count - eliminate false positives

[forlinuxsupport]

Hi

Is it possible to have zabbix do a down count before it fires the trigger.

E.g. If I monitor SMTP on a server and zabbix checks it and its down it immediately fires off a text (sms) alert to me.

Can I get it to check if smtp is down 3 times (say 1 minute apart) then only fire a text off to me if its been down for the full 3 minutes ?.

I'm tired ot getting false alerts

cheers
Andy

[peter_field]

Use max function

Yes, simply change your triggers from:
{host:smtp.last(0)}#1
to:
{host:smtp.max(300)}#1
or:
{host:smtp.max(#3)}#1

max(300) will report the maximum the value was for the last 300 seconds, so if 0 means the host is down, and 1 means it is up, then max(300) will only be 0 if the host was down for the entire 300 seconds.

The alternate max(#3) means the maximum value for the last 3 checks, so if your item checks every minute, then max(#3) will give you the maximum value over approx 3 minutes.

As of 1.1.2, smtp and other checks like this now return 2 if the item timed out, and 0 if it was unreachable. You might consider using a trigger like this:

({host:smtp.last(0)}<1)|({host:smtp.max(#2)}>1)

This will fire the trigger immediately if the host is unreachable, but only fire the trigger if the host timed out for the last 2 checks in a row.

Hope this helps.

[forlinuxsupport]

you are the man... thanks very much

Any way to do that globally ?
E.g I have about 100 severs monitoring smtp on them, can I change it on one and it will update all the others ?

Cheers
andy

[ShivaS]

check templates.

[nelsonab]

I added this to the Documentation thread in the hopes that someone might catch this and add it to the docs. I found the docs to be somewhat lacking in explanations at times which has been somewhat frustrating. :-)

[s0enke]

Hi,

Shouldn't this feature be a common one? If you are monitoring services on a remote location there's a good chance that there are short network issues (or so) and an UNREACHABLE trigger is fired immediately.

This max() thing works but it looks more like a tricky/dirty hack/workaround for a real common feature (because this is max() in conjunction with a boolean value (0/1) and I guess not the initial intention of max() ...). Isn't there really no *native* way to support a trigger-file delay?!

Thanks!