The expressions used in triggers are very flexible. You can use them to create complex logical tests regarding
monitored statistics.
| Function | Definition |
| abschange | Returns absolute difference between last and previous value. |
| avg | Average value for period of time. Parameter defines length of the period in seconds. |
| delta | Same as max()-min() |
| change | Returns difference between last and previous value. |
| count | Number of successfully retrieved values for period of time. Parameter defines length of the period in seconds. |
| date | Returns current date in YYYYMMDD format.
For example:
200310251 |
| diff | Returns:
1 – if last and previous values differs
0 – otherwise |
| last | Last (most recent) value. Parameter is ignored. |
| max | Maximal value for period of time. Parameter defines length of the period in seconds. |
| min | Minimal value for period of time. Parameter defines length of the period in seconds. |
| nodata | Returns:
1 – if no data received during period of time. Parameter defines length of the period in seconds. The length should not be less than 30 seconds.
Can be used for item type TRAPPER only! |
| now | Returns number of seconds since the Epoch (00:00:00 UTC, January 1, 1970). |
| prev | Returns previous value. Parameter is ignored. |
| str | Find string in last (most recent) value. Parameter defines string to find. Returns:
1 – found
0 – otherwise
Can be used for items having type STRING only. |
| sum | Sum of values for period of time. Parameter defines length of the period in seconds. |
| time | Returns current time in HHMMSS format.
Example:
123055 |
Note: Note that all above functions (except diff and str) cannot be used for non-numeric parameters!
Parameter must be given even for those functions, which ignore it. Example: last(0)
- Example 1. Processor load is too high on zabbix.sf.net.
{zabbix.sf.net:system[procload].last(0)}>5
‘zabbix.sf.net:system[procload]’ gives a short name of the monitored parameter. It specifies that the server is
‘sourceforge.net’ and the key being monitored is ‘system[procload]’. By using the function ‘last()’, we are
referring to the most recent value. Finally, ‘>5’ means that the trigger is true whenever the most
recent processor load measurement from zabbix.sf.net is greater than 5.
- Example 2. zabbix.sf.net is overloaded.
({zabbix.sf.net:system[procload].last(0)}>5)|({zabbix.sf.net:system[procload].min(600)}>2)
The expression is true when either the current processor load is more than 5 or the processor load was more
than 2 during last 10 minutes.
- Example 3. /etc/passwd has been changed.
Use of function diff:
({zabbix.sf.net:cksum[/etc/passwd].diff(0)})>0
The expression is true when the previous value of checksum of /etc/passwd differs from the most recent one.
Similar expressions could be useful to monitor changes in important files, such as /etc/passwd, /etc/inetd.conf,
/kernel, etc.
- Example 4. Someone downloads big file from the Internet.
Use of function min:
({zabbix.sf.net:netloadin1[eth0].min(300)})>100K
The expression is true when number of received bytes on eth0 is more than 100 KB within last 5 minutes.
- Example 5. Both clustered SMTP servers are down.
Note use of two different hosts in one expression:
({smtp1.zabbix.com:check_service[smtp].last(0)}=0)&({smtp2.zabbix.com:check_service[smtp].last(0)}=0)
The expression is true when both SMTP server is down on both smtp1.zabbix.com and smtp2.zabbix.com.
- Example 6. Zabbix agent needs to be upgraded.
Use of function str():
{zabbix.zabbix.com:version[zabbix_agent].str(beta8)}=0
The expression is true if ZABBIX agent has version beta8 (presumably 1.0beta8).
- Example 7. Server is unreachable.
{zabbix.zabbix.com:status.last(0)}=2
Note:Note ‘status’ is special parameter which is calculated if and only if corresponding host has at least
one parameter for monitoring. See description of ‘status’ for more details.
- Example 8. No heart beats within last 3 minutes.
Use of function nodata():
{zabbix.zabbix.com:tick.nodata(180)}=1
‘tick’ must have type ‘ZABBIX trapper’’. In order to make this trigger work, item ‘tick’ must be defined. The host
should periodically send data for this parameter using zabbix_sender. If no data is received within
180 seconds, the trigger value becomes TRUE.
- Example 9. CPU activity at night time
Use of function time():
({zabbix:system[procload].nodata(180)}=1)&({zabbix:system[procload].time(0)}>000000)&
({zabbix:system[procload].time(0)}<060000)
The trigger may change its status to true, only at night (00:00-06:00) time.
Initial