The expressions used in triggers are very flexible. You can use them to create complex logical tests regarding
monitored statistics.
| Function | Definition |
|---|
| abschange | Returns absolute difference between last and previous value. |
|---|
| avg | Average value for period of time. Parameter defines length of the period in seconds. |
|---|
| delta | Same as max()-min() |
|---|
| change | Returns difference between last and previous value. |
|---|
| count | Number of successfully retrieved values for period of time. Parameter defines length of the period in seconds. |
|---|
| date | Returns current date in YYYYMMDD format.
For example:
200310251 |
|---|
| dayofweek | Returns current day of week, in the range 1 to 7. Mon - 1, Sun - 7. |
|---|
| diff | Returns:
1 – if last and previous values differs
0 – otherwise |
|---|
| fuzzytime | Returns 1 if timestamp does not differ from ZABBIX server time for more than <parameter> seconds. Normally used with system.localtime |
|---|
| last | Last (most recent) value. Parameter is ignored. |
|---|
| max | Maximal value for period of time. Parameter defines length of the period in seconds. |
|---|
| min | Minimal value for period of time. Parameter defines length of the period in seconds. |
|---|
| nodata | Returns:
1 – if no data received during period of time. Parameter defines length of the period in seconds. The length should not be less than 30 seconds. |
|---|
| now | Returns number of seconds since the Epoch (00:00:00 UTC, January 1, 1970). |
|---|
| prev | Returns previous value. Parameter is ignored. |
|---|
| str | Find string in last (most recent) value. Parameter defines string to find. Returns:
1 – found
0 – otherwise
Can be used for items having type STRING only. |
|---|
| sum | Sum of values for period of time. Parameter defines length of the period in seconds. |
|---|
| time | Returns current time in HHMMSS format.
Example:
123055 |
|---|
Note: Note that all above functions (except diff and str) cannot be used for non-numeric parameters!
Parameter must be given even for those functions, which ignore it. Example: last(0)
- Example 1. Processor load is too high on zabbix.sf.net.
{zabbix.sf.net:system[procload].last(0)}>5
‘zabbix.sf.net:system[procload]’ gives a short name of the monitored parameter. It specifies that the server is
‘sourceforge.net’ and the key being monitored is ‘system[procload]’. By using the function ‘last()’, we are
referring to the most recent value. Finally, ‘>5’ means that the trigger is true whenever the most
recent processor load measurement from zabbix.sf.net is greater than 5.
- Example 2. zabbix.sf.net is overloaded.
({zabbix.sf.net:system[procload].last(0)}>5)|({zabbix.sf.net:system[procload].min(600)}>2)
The expression is true when either the current processor load is more than 5 or the processor load was more
than 2 during last 10 minutes.
- Example 3. /etc/passwd has been changed.
Use of function diff:
({zabbix.sf.net:cksum[/etc/passwd].diff(0)})>0
The expression is true when the previous value of checksum of /etc/passwd differs from the most recent one.
Similar expressions could be useful to monitor changes in important files, such as /etc/passwd, /etc/inetd.conf,
/kernel, etc.
- Example 4. Someone downloads big file from the Internet.
Use of function min:
({zabbix.sf.net:netloadin1[eth0].min(300)})>100K
The expression is true when number of received bytes on eth0 is more than 100 KB within last 5 minutes.
- Example 5. Both clustered SMTP servers are down.
Note use of two different hosts in one expression:
({smtp1.zabbix.com:check_service[smtp].last(0)}=0)&({smtp2.zabbix.com:check_service[smtp].last(0)}=0)
The expression is true when both SMTP server is down on both smtp1.zabbix.com and smtp2.zabbix.com.
- Example 6. Zabbix agent needs to be upgraded.
Use of function str():
{zabbix.zabbix.com:version[zabbix_agent].str(beta8)}=0
The expression is true if ZABBIX agent has version beta8 (presumably 1.0beta8).
- Example 7. Server is unreachable.
{zabbix.zabbix.com:status.last(0)}=2
Note:Note ‘status’ is special parameter which is calculated if and only if corresponding host has at least
one parameter for monitoring. See description of ‘status’ for more details.
- Example 8. No heart beats within last 3 minutes.
Use of function nodata():
{zabbix.zabbix.com:tick.nodata(180)}=1
‘tick’ must have type ‘ZABBIX trapper’’. In order to make this trigger work, item ‘tick’ must be defined. The host
should periodically send data for this parameter using zabbix_sender. If no data is received within
180 seconds, the trigger value becomes TRUE.
- Example 9. CPU activity at night time
Use of function time():
({zabbix:system[procload].nodata(180)}=1)&({zabbix:system[procload].time(0)}>000000)&
({zabbix:system[procload].time(0)}<060000)
The trigger may change its status to true, only at night (00:00-06:00) time.
Advanced