Zabbix Documentation 2.0

1.8  
2.0
  2.2  2.4  3.0

User Tools

Site Tools


Sidebar

manual:appendix:triggers:functions

1 Supported trigger functions

All functions supported in trigger expressions are listed here:

FUNCTION
Description Parameters Comments
abschange
The amount of absolute difference between last and previous values. Supported value types: float, int, str, text, log

For example:
(previous value/last value=abschange)
1/5=4
3/1=2
0/-2.5=2.5

For strings returns:
0 - values are equal
1 - values differ
avg (sec|#num,<time_shift>)
Average value of an item within the defined evaluation period. sec or #num - evaluation period in seconds or in latest collected values (preceded by a hash mark)
time_shift (optional) - evaluation point is moved the number of seconds back in time
Supported value types: float, int

Examples:
⇒ avg(#5) → average value for the five latest values
⇒ avg(3600) → average value for an hour
⇒ avg(3600,86400) → average value for an hour one day ago.

The time_shift parameter is supported since Zabbix 1.8.2. It is useful when there is a need to compare the current average value with the average value time_shift seconds back.
change
The amount of difference between last and previous values. Supported value types: float, int, str, text, log

For example:
(previous value/last value=change)
1/5=+4
3/1=-2
0/-2.5=-2.5

For strings returns:
0 - values are equal
1 - values differ
count (sec|#num,<pattern>,<operator>,<time_shift>)
Number of values within the defined evaluation period. sec or #num - evaluation period in seconds or in latest collected values (preceded by a hash mark)
pattern (optional) - required pattern (integer items - exact match; float items - match within 0.000001)
operator (optional)

Supported operators:
eq - equal
ne - not equal
gt - greater
ge - greater or equal
lt - less
le - less or equal
like - matches if contains pattern (case-sensitive)

Note that:
eq (default), ne, gt, ge, lt, le are supported for integer items
eq (default), ne, gt, ge, lt, le are supported for float items
like (default), eq, ne are supported for string, text and log items

time_shift (optional) - see avg()
Supported value types: float, int, str, text, log

Examples:
⇒ count(600) → number of values for last 10 minutes
⇒ count(600,12) → number of values for last 10 minutes that equal '12'
⇒ count(600,12,"gt") → number of values for last 10 minutes that are over '12'
⇒ count(#10,12,"gt") → number of values within last 10 values that are over '12'
⇒ count(600,12,"gt",86400) → number of values for preceding 10 minutes up to 24 hours ago that were over '12'
⇒ count(600,,,86400) → number of values for preceding 10 minutes up to 24 hours ago

The #num parameter is supported since Zabbix 1.6.1.
The time_shift parameter and string operators are supported since Zabbix 1.8.2.
date
Current date in YYYYMMDD format. Supported value types: any

Example of returned value: 20150731
dayofmonth
Day of month in range of 1 to 31. Supported value types: any

This function is supported since Zabbix 1.8.5.
dayofweek
Day of week in range of 1 to 7 (Mon - 1, Sun - 7). Supported value types: any
delta (sec|#num,<time_shift>)
Difference between the maximum and minimum values within the defined evaluation period ('max()' minus 'min()'). sec or #num - evaluation period in seconds or in latest collected values specified (preceded by a hash mark)
time_shift (optional) - see avg()
Supported value types: float, int

The time_shift parameter is supported since Zabbix 1.8.2.
diff
Checking if last and previous values differ. Supported value types: float, int, str, text, log

Returns:
1 - last and previous values differ
0 - otherwise
fuzzytime (sec)
Checking if system local time is in sync with Zabbix server time. sec - seconds Supported value types: float, int

Returns '1' if the timestamp from item value does not differ from Zabbix server time for more than N seconds, 0 - otherwise. Usually used with system.localtime to check that local time is in sync with local time of Zabbix server.
iregexp (pattern,<sec|#num>)
This function is a non case-sensitive analogue of regexp(). see regexp() Supported value types: str, log, text
last (sec|#num,<time_shift>)
The most recent value. sec (ignored) or #num - the Nth most recent value
time_shift (optional) - see avg()
Supported value types: float, int, str, text, log

Take note that #num works differently here than with many other functions.
For example:
last() is always equal to last(#1)
last(#3) - third most recent value (not three latest values)

Zabbix does not guarantee exact order of values if more than two values exist within one second in history.

The #num parameter is supported since Zabbix 1.6.2.
The time_shift parameter is supported since Zabbix 1.8.2.
logeventid (pattern)
Check if event ID of the last log entry matches a regular expression. pattern - regular expression describing the required pattern, POSIX extended style. Supported value types: log

Returns:
0 - does not match
1 - matches

This function is supported since Zabbix 1.8.5.
logseverity
Log severity of the last log entry. Supported value types: log

Returns:
0 - default severity
N - severity (integer, useful for Windows event logs: 1 - Information, 2 - Warning, 4 - Error, 7 - Failure Audit, 8 - Success Audit, 9 - Critical, 10 - Verbose).
Zabbix takes log severity from Information field of Windows event log.
logsource (pattern)
Checking if log source of the last log entry matches parameter. pattern - required string Supported value types: log

Returns:
0 - does not match
1 - matches
Normally used for Windows event logs. For example, logsource("VMware Server").
max (sec|#num,<time_shift>)
Highest value of an item within the defined evaluation period. sec or #num - evaluation period in seconds or in latest collected values (preceded by a hash mark)
time_shift (optional) - see avg()
Supported value types: float, int

The time_shift parameter is supported since Zabbix 1.8.2.
min (sec|#num,<time_shift>)
Lowest value of an item within the defined evaluation period. sec or #num - evaluation period in seconds or in latest collected values (preceded by a hash mark)
time_shift (optional) - see avg()
Supported value types: float, int

The time_shift parameter is supported since Zabbix 1.8.2.
nodata (sec)
Checking for no data received. sec - evaluation period in seconds. The period should not be less than 30 seconds. Supported value types: any

Returns:
1 - if no data received during the defined period of time
0 - otherwise

Note that this function will display an error if, within the period of the 1st parameter:
- there's no data and Zabbix server was restarted
- there's no data and maintenance was completed
- there's no data and the item was added or re-enabled
now
Number of seconds since the Epoch (00:00:00 UTC, January 1, 1970). Supported value types: any
prev
Previous value. Supported value types: float, int, str, text, log

Returns the same as last(#2).
regexp (pattern,<sec|#num>)
Checking if the latest (most recent) value matches regular expression. pattern - regular expression, POSIX extended style.
sec or #num (optional) - evaluation period in seconds or in latest collected values (preceded by a hash mark). In this case, more than one value may be processed.
Supported value types: str, text, log

Returns:
1 - found
0 - otherwise

This function is case-sensitive.
str (pattern,<sec|#num>)
Finding a string in the latest (most recent) value. pattern - required string
sec or #num (optional) - evaluation period in seconds or in latest collected values (preceded by a hash mark). In this case, more than one value may be processed.
Supported value types: str, text, log

Returns:
1 - found
0 - otherwise

This function is case-sensitive.
strlen (sec|#num,<time_shift>)
Length of the latest (most recent) value in characters (not bytes). sec (ignored) or #num - the Nth most recent value
time_shift (optional) - see avg()
Supported value types: str, text, log

Take note that #num works differently here than with many other functions.

Examples:
⇒ strlen()(is equal to strlen(#1)) → length of the latest value
⇒ strlen(#3) → length of the third most recent value
⇒ strlen(,86400) → length of the most recent value one day ago.

This function is supported since Zabbix 1.8.4.
sum (sec|#num,<time_shift>)
Sum of collected values within the defined evaluation period. sec or #num - evaluation period in seconds or in latest collected values (preceded by a hash mark)
time_shift (optional) - see avg()
Supported value types: float, int

The time_shift parameter is supported since Zabbix 1.8.2.
time
Current time in HHMMSS format. Supported value types: any

Example of returned value: 123055

1) All functions return numeric values only. Comparison to strings is not supported, for example.
2) Some of the functions cannot be used for non-numeric parameters!
3) String arguments should be double quoted. Otherwise, they might get misinterpreted.