Hi everyone.
My trigger is sometimes triggered for much longer time than it should be. It is defined in a following way:
Expression: ({snmptrapper:snmptraps.str(TRAP)}=1)&({snmptrappe r:snmptraps.nodata(30)}=0)
(my script that notifies Zabbix via zabbix_sender takes a message and inserts string "TRAP: " in the beginning, maybe it could be better using the nodata function instead of the str but that's not the point in this post)
What I would expect is that the trigger should be triggered once the item gets a value containing "TRAP" and if it does not receive data for 30 seconds, it should return to normal state.
Most of the time it works as expected, but sometimes the trigger is active for much longer, for example 1h12min. But in latest data there is only one value (that triggered it originally).
I was not able to find out why this happens and how to rectify it. Any hints anyone?
Running Zabbix version is 1.8.1 running on Debian in VMWare (the VMWare had enough resources though).
ITEM
Description: snmptraps
Type: Zabbix trapper
Key: snmptraps
Type of information: Log
Events:
2010.Jul.27 08:14:30 !!!TRAP ACTIVE!!! OK Average 2h 26m 8s No Ok
2010.Jul.27 07:02:14 !!!TRAP ACTIVE!!! PROBLEM Average 1h 12m 16s No Ok
Item history:
[2010.Jul.27 07:02:14] - - Not classified - TRAP: 192.168.200.1 Jul 27 07:02:14 --- 1082: Jul 27 07:02:13.741 MET-DST: %DHCP_SNOOPING-5-DHCP_SNOOPING_MATCH_MAC_FAIL: DHCP_SNOOPING drop message because the chaddr doesn't match source mac, message type: DHCPDISCOVER, chaddr: e16c.d6ae.5290, MAC sa: 001e.ec1f.f462
Martin
My trigger is sometimes triggered for much longer time than it should be. It is defined in a following way:
Expression: ({snmptrapper:snmptraps.str(TRAP)}=1)&({snmptrappe r:snmptraps.nodata(30)}=0)
(my script that notifies Zabbix via zabbix_sender takes a message and inserts string "TRAP: " in the beginning, maybe it could be better using the nodata function instead of the str but that's not the point in this post)
What I would expect is that the trigger should be triggered once the item gets a value containing "TRAP" and if it does not receive data for 30 seconds, it should return to normal state.
Most of the time it works as expected, but sometimes the trigger is active for much longer, for example 1h12min. But in latest data there is only one value (that triggered it originally).
I was not able to find out why this happens and how to rectify it. Any hints anyone?
Running Zabbix version is 1.8.1 running on Debian in VMWare (the VMWare had enough resources though).
ITEM
Description: snmptraps
Type: Zabbix trapper
Key: snmptraps
Type of information: Log
Events:
2010.Jul.27 08:14:30 !!!TRAP ACTIVE!!! OK Average 2h 26m 8s No Ok
2010.Jul.27 07:02:14 !!!TRAP ACTIVE!!! PROBLEM Average 1h 12m 16s No Ok
Item history:
[2010.Jul.27 07:02:14] - - Not classified - TRAP: 192.168.200.1 Jul 27 07:02:14 --- 1082: Jul 27 07:02:13.741 MET-DST: %DHCP_SNOOPING-5-DHCP_SNOOPING_MATCH_MAC_FAIL: DHCP_SNOOPING drop message because the chaddr doesn't match source mac, message type: DHCPDISCOVER, chaddr: e16c.d6ae.5290, MAC sa: 001e.ec1f.f462
Martin
Comment