This is the documentation page for an unsupported version of Zabbix.
Is this not what you were looking for? Switch to the current version or choose one from the drop-down menu.
Table of Contents

1 Supported trigger functions

All functions supported in trigger expressions are listed here:

FUNCTION
Description Parameters Comments
abschange
The amount of absolute difference between last and previous values. Supported value types: float, int, str, text, log

For example:
(previous value;last value=abschange)
1;5=4
3;1=2
0;-2.5=2.5

For strings returns:
0 - values are equal
1 - values differ
avg (sec|#num,<time_shift>)
Average value of an item within the defined evaluation period. sec or #num - evaluation period in seconds or in latest collected values (preceded by a hash mark)
time_shift (optional) - evaluation point is moved the number of seconds back in time
Supported value types: float, int

Examples:
=> avg(#5) → average value for the five latest values
=> avg(3600) → average value for an hour
=> avg(3600,86400) → average value for an hour one day ago.

The time_shift parameter is supported since Zabbix 1.8.2. It is useful when there is a need to compare the current average value with the average value time_shift seconds back.
change
The amount of difference between last and previous values. Supported value types: float, int, str, text, log

For example:
(previous value;last value=change)
1;5=+4
3;1=-2
0;-2.5=-2.5

For strings returns:
0 - values are equal
1 - values differ
count (sec|#num,<pattern>,<operator>,<time_shift>)
Number of values within the defined evaluation period. sec or #num - evaluation period in seconds or in latest collected values (preceded by a hash mark)
pattern (optional) - required pattern

operator (optional)

Supported operators:
eq - equal
ne - not equal
gt - greater
ge - greater or equal
lt - less
le - less or equal
like - matches if contains pattern (case-sensitive)

Note that:
eq (default), ne, gt, ge, lt, le are supported for integer items
eq (default), ne, gt, ge, lt, le are supported for float items
like (default), eq, ne are supported for string, text and log items

time_shift (optional) - see avg()
Supported value types: float, integer, string, text, log
Float items match with the precision of 0.000001.

Examples:
=> count(600) → number of values for last 10 minutes
=> count(10m,"error",eq) → number of values for last 10 minutes that equal 'error'
=> count(600,12) → number of values for last 10 minutes that equal '12'
=> count(600,12,gt) → number of values for last 10 minutes that are over '12'
=> count(#10,12,gt) → number of values within last 10 values that are over '12'
=> count(600,12,gt,86400) → number of values for preceding 10 minutes up to 24 hours ago that were over '12'
=> count(600,,,86400) → number of values for preceding 10 minutes up to 24 hours ago

The #num parameter is supported since Zabbix 1.6.1.
The time_shift parameter and string operators are supported since Zabbix 1.8.2.
date
Current date in YYYYMMDD format. Supported value types: any

Example of returned value: 20150731
dayofmonth
Day of month in range of 1 to 31. Supported value types: any

This function is supported since Zabbix 1.8.5.
dayofweek
Day of week in range of 1 to 7 (Mon - 1, Sun - 7). Supported value types: any
delta (sec|#num,<time_shift>)
Difference between the maximum and minimum values within the defined evaluation period ('max()' minus 'min()'). sec or #num - evaluation period in seconds or in latest collected values specified (preceded by a hash mark)
time_shift (optional) - see avg()
Supported value types: float, int

The time_shift parameter is supported since Zabbix 1.8.2.
diff
Checking if last and previous values differ. Supported value types: float, int, str, text, log

Returns:
1 - last and previous values differ
0 - otherwise
fuzzytime (sec)
Checking how much an item timestamp value differs from the Zabbix server time. sec - seconds Supported value types: float, int

Returns:
0 - if difference between item timestamp value and Zabbix server timestamp is over T seconds
1 - otherwise.

Usually used with system.localtime to check that local time is in sync with local time of Zabbix server.
Can be used also with vfs.file.time[/path/file,modify] key to check that file didn't get updates for long time.

Example:
=> fuzzytime(60)=0 → detect a problem if time difference is over 60 seconds
iregexp (pattern,<sec|#num>)
This function is a non case-sensitive analogue of regexp(). see regexp() Supported value types: str, log, text
last (sec|#num,<time_shift>)
The most recent value. sec (ignored) or #num - the Nth most recent value
time_shift (optional) - see avg()
Supported value types: float, int, str, text, log

Take note that #num works differently here than with many other functions.
For example:
last() is always equal to last(#1)
last(#3) - third most recent value (not three latest values)

Zabbix does not guarantee exact order of values if more than two values exist within one second in history.

The #num parameter is supported since Zabbix 1.6.2.
The time_shift parameter is supported since Zabbix 1.8.2.
logeventid (pattern)
Check if event ID of the last log entry matches a regular expression. pattern - regular expression describing the required pattern, POSIX extended style. Supported value types: log

Returns:
0 - does not match
1 - matches

This function is supported since Zabbix 1.8.5.
logseverity
Log severity of the last log entry. Supported value types: log

Returns:
0 - default severity
N - severity (integer, useful for Windows event logs: 1 - Information, 2 - Warning, 4 - Error, 7 - Failure Audit, 8 - Success Audit, 9 - Critical, 10 - Verbose).
Zabbix takes log severity from Information field of Windows event log.
logsource (pattern)
Checking if log source of the last log entry matches parameter. pattern - required string Supported value types: log

Returns:
0 - does not match
1 - matches
Normally used for Windows event logs. For example, logsource("VMware Server").
max (sec|#num,<time_shift>)
Highest value of an item within the defined evaluation period. sec or #num - evaluation period in seconds or in latest collected values (preceded by a hash mark)
time_shift (optional) - see avg()
Supported value types: float, int

The time_shift parameter is supported since Zabbix 1.8.2.
min (sec|#num,<time_shift>)
Lowest value of an item within the defined evaluation period. sec or #num - evaluation period in seconds or in latest collected values (preceded by a hash mark)
time_shift (optional) - see avg()
Supported value types: float, int

The time_shift parameter is supported since Zabbix 1.8.2.
nodata (sec)
Checking for no data received. sec - evaluation period in seconds. The period should not be less than 30 seconds. Supported value types: any

Returns:
1 - if no data received during the defined period of time
0 - otherwise

Note that this function will display an error if, within the period of the 1st parameter:
- there's no data and Zabbix server was restarted
- there's no data and maintenance was completed
- there's no data and the item was added or re-enabled
Errors are displayed in the Info column in trigger configuration.
now
Number of seconds since the Epoch (00:00:00 UTC, January 1, 1970). Supported value types: any
prev
Previous value. Supported value types: float, int, str, text, log

Returns the same as last(#2).
regexp (pattern,<sec|#num>)
Checking if the latest (most recent) value matches regular expression. pattern - regular expression, POSIX extended style.
sec or #num (optional) - evaluation period in seconds or in latest collected values (preceded by a hash mark). In this case, more than one value may be processed.
Supported value types: str, text, log

Returns:
1 - found
0 - otherwise

This function is case-sensitive.
str (pattern,<sec|#num>)
Finding a string in the latest (most recent) value. pattern - required string
sec or #num (optional) - evaluation period in seconds or in latest collected values (preceded by a hash mark). In this case, more than one value may be processed.
Supported value types: str, text, log

Returns:
1 - found
0 - otherwise

This function is case-sensitive.
strlen (sec|#num,<time_shift>)
Length of the latest (most recent) value in characters (not bytes). sec (ignored) or #num - the Nth most recent value
time_shift (optional) - see avg()
Supported value types: str, text, log

Take note that #num works differently here than with many other functions.

Examples:
=> strlen()(is equal to strlen(#1)) → length of the latest value
=> strlen(#3) → length of the third most recent value
=> strlen(,86400) → length of the most recent value one day ago.

This function is supported since Zabbix 1.8.4.
sum (sec|#num,<time_shift>)
Sum of collected values within the defined evaluation period. sec or #num - evaluation period in seconds or in latest collected values (preceded by a hash mark)
time_shift (optional) - see avg()
Supported value types: float, int

The time_shift parameter is supported since Zabbix 1.8.2.
time
Current time in HHMMSS format. Supported value types: any

Example of returned value: 123055
  1. All functions return numeric values only. Comparison to strings is not supported, for example.
  2. Some of the functions cannot be used for non-numeric parameters!
  3. String arguments should be double quoted. Otherwise, they might get misinterpreted.