User Tools

Site Tools


2.0:manual:appendix:triggers:functions

1 Supported trigger functions

All functions supported in trigger expressions are listed here:

FUNCTION Parameter(s) Supported value types
Definition
abschange ignored float, int, str, text, log
Returns absolute difference between last and previous values.
For strings:
0 - values are equal
1 - values differ
avg sec or #num float, int
The average value of a period. The period is set in seconds or as a number of collected values (preceded by a # hash mark, for example, #5 - five latest values) in the first parameter.
The function accepts a second, optional parameter time_shift. It is useful when there is a need to compare the current average value with the average value time_shift seconds back. For instance, avg(3600,86400) will return the average value for an hour one day ago.
Parameter time_shift is supported from Zabbix 1.8.2.
change ignored float, int, str, text, log
Returns difference between last and previous values.
For strings:
0 - values are equal
1 - values differ
count sec or #num float, int, str, text, log
The number of collected values in a period. The period is set in seconds or as a number of values (preceded by a # hash mark) in the first parameter.
The function accepts a second optional pattern parameter, a third operator parameter, and a fourth time_shift parameter.
For pattern: integer items - exact match; float items - match within 0.000001
Supported operators *:
eq - equal
ne - not equal
gt - greater
ge - greater or equal
lt - less
le - less or equal
like - matches if contains pattern.
*For integer and float items: operators eq (default), ne, gt, ge, lt, le are supported.
*For string, text and log items: operators like (default), eq, ne are supported.
Examples:
count(600) - the number of values for last 10 minutes
count(600,12) - the number of values for last 10 minutes that equal '12'
count(600,12,"gt") - the number of values for last 10 minutes that are over '12'
count(#10,12,"gt") - the number of values within last 10 values that are over '12'
count(600,12,"gt",86400) - the number of values for preceding 10 minutes up to 24 hours ago that were over '12'
count(600,,,86400) - the number of values for preceding 10 minutes up to 24 hours ago
#num parameter is supported from Zabbix 1.6.1.
time_shift parameter and string operators are supported from Zabbix 1.8.2. See function avg() for an example of using time_shift.
date ignored any
Returns current date in YYYYMMDD format.
For example: 20031025
dayofmonth ignored any
Returns day of month in range of 1 to 31.
This function is supported since Zabbix 1.8.5.
dayofweek ignored any
Returns day of week in range of 1 to 7. Mon - 1, Sun - 7.
delta sec or #num float, int
Returns the difference between the maximum and minimum values in a period ('max()' minus 'min()'). The period is set in seconds or as a number of collected values (preceded by a # hash mark) in the first parameter.
Since Zabbix 1.8.2, the function supports a second, optional parameter time_shift. See function avg() for an example of its use.
diff ignored float, int, str, text, log
Returns:
1 - last and previous values differ
0 - otherwise
fuzzytime sec float, int
Returns 1 if timestamp (item value) does not differ from Zabbix server time for more than N seconds, 0 - otherwise.
Usually used with system.localtime to check that local time is in sync with local time of Zabbix server.
iregexp 1st - string, 2nd - sec or #num str, log, text
This function is non case-sensitive analogue of regexp.
last sec or #num float, int, str, text, log
Last (most recent) value. Parameter:
sec - ignored
#num - Nth most recent value
Take note that #num, as can be expected, works differently here than with many other functions.
For example,
last(0) is always equal to last(#1)
last(#3) - third most recent value (not three latest values)
The function also supports a second optional time_shift parameter. For example,
last(0,86400) will return the most recent value one day ago.
Zabbix does not guarantee exact order of values if more than two values exist within one second in history.
Parameter #num is supported starting from Zabbix 1.6.2.
Parameter time_shift is supported starting from Zabbix 1.8.2. See function avg() for an example of its use.
logeventid string log
Check if Event ID of the last log entry matches a regular expression. Parameter defines the regular expression, POSIX extended style.
Returns:
0 - does not match
1 - matches
This function is supported since Zabbix 1.8.5.
logseverity ignored log
Returns log severity of the last log entry. Parameter is ignored.
0 - default severity
N - severity (integer, useful for Windows event logs). Zabbix takes log severity from field Information of Windows event log.
logsource string log
Check if log source of the last log entry matches parameter.
0 - does not match
1 - matches
Normally used for Windows event logs. For example, logsource["VMWare Server"]
max sec or #num float, int
The maximum (highest) value of a period. The period is set in seconds or as a number of collected values (preceded by a # hash mark) in the first parameter.
Since Zabbix 1.8.2, the function supports a second, optional parameter time_shift. See function avg for an example of its use.
min sec or #num float, int
The minimum (lowest) value of a period. The period is set in seconds or as a number of collected values (preceded by a # hash mark) in the first parameter.
Since Zabbix 1.8.2, the function supports a second, optional parameter time_shift. See function avg for an example of its use.
nodata sec any
Returns:
1 - if no data received during period of time in seconds. The period should not be less than 30 seconds.
0 - otherwise
now ignored any
Returns number of seconds since the Epoch (00:00:00 UTC, January 1, 1970).
prev ignored float, int, str, text, log
Returns previous value. Parameter is ignored.
Same as last(#2)
regexp 1st - string, 2nd - sec or #num str, log, text
Check if last (most recent) value matches regular expression. Parameter defines regular expression, POSIX extended style.
Second optional parameter is number of seconds or number of collected values to analyse. In this case more than one value will be processed.
This function is case-sensitive.
Returns:
1 - found
0 - otherwise
str 1st - string, 2nd - sec or #num str, log, text
Find string in last (most recent) value. Parameter defines string to find. Case sensitive!
Second optional parameter is number of seconds or number of collected values to analyse. In this case more than one value will be processed.
Returns:
1 - found
0 - otherwise
strlen sec or #num str, log, text
Length of the last (most recent) value in characters (not bytes).
Parameters work the same as with 'last' function (see above in the table).
For example,
strlen(0) is equal to strlen(#1)
strlen(#3) - length of the third most recent value
strlen(0,86400) - length of the most recent value one day ago.
This function is supported since Zabbix 1.8.4.
sum sec or #num float, int
The sum of collected values in a period. The period is set in seconds or as a number of values (preceded by a # hash mark) in the first parameter.
Since Zabbix 1.8.2, the function supports a second, optional parameter time_shift. See function avg for an example of its use.
time ignored any
Returns current time in HHMMSS format. Example: 123055

1) All functions return numeric values only. Comparison to strings is not supported, for example.
2) Some of the functions cannot be used for non-numeric parameters!
3) String arguments should be double quoted. Otherwise, they might get misinterpreted.