Zabbix Documentation 2.4

3.04.04.45.0 (current)| In development:5.2 (devel)| Unsupported:1.82.02.22.43.23.44.2Guidelines

User Tools

Site Tools


manual:appendix:triggers:functions

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Previous revision
Last revision Both sides next revision
manual:appendix:triggers:functions [2019/03/17 14:35]
manual:appendix:triggers:functions [2019/07/09 08:59]
martins-v old revision restored (2019/07/08 05:32)
Line 1: Line 1:
 +==== 1 Supported trigger functions ====
  
 +All functions supported in [[:​manual/​config/​triggers/​expression|trigger expressions]] are listed here:
 +
 +^ FUNCTION ​ ^^^^
 +^ ^  **Description** ​ ^  **Parameters** ​ ^  **Comments** ​ ^
 +|**abschange** ​ ^^^^
 +^ |The amount of absolute difference between last and previous values. ​ |  |Supported value types: float, int, str, text, log\\ \\ For example:\\ (previous value;last value=abschange)\\ 1;5=4\\ 3;1=2\\ 0;​-2.5=2.5\\ \\ For strings returns:\\ 0 - values are equal\\ 1 - values differ ​ |
 +^ ||||
 +|**avg** (sec<​nowiki>​|</​nowiki>#​num,<​time_shift>​) ​ ^^^^
 +^ |Average value of an item within the defined evaluation period. ​ |**sec** or **#num** - evaluation period in seconds or in latest collected values (preceded by a hash mark)\\ **time_shift** (optional) - evaluation point is moved the number of seconds back in time  |Supported value types: float, int\\ \\ Examples:\\ => avg(#5) -> average value for the five latest values\\ => avg(3600) -> average value for an hour\\ => avg(3600,​86400) -> average value for an hour one day ago.\\ \\ The ''​time_shift''​ parameter is supported since Zabbix 1.8.2. It is useful when there is a need to compare the current average value with the average value time_shift seconds back.  |
 +^ ||||
 +|**band** (sec<​nowiki>​|</​nowiki>#​num,​mask,<​time_shift>​) ​ ^^^^
 +^ |Value of "​bitwise AND" of an item value and mask.  |**sec** (ignored) or **#num** - the Nth most recent value\\ **mask** (mandatory) - 64-bit unsigned integer (0 - 18446744073709551615)\\ **time_shift** (optional) - see avg()  |Supported value types: int\\ \\ Take note that ''#​num''​ works differently here than with many other functions (see last()).\\ \\ Although the comparison is done in a bitwise manner, all the values must be supplied and are returned in decimal. For example, checking for the 3rd bit is done by comparing to 4, not 100.\\ \\ Examples:\\ => %%band(,​12)=8 or band(,​12)=4%% -> 3rd or 4th bit set, but not both at the same time\\ => %%band(,​20)=16%% -> 3rd bit not set and 5th bit set.\\ \\ This function is supported since Zabbix 2.2.0. ​ |
 +^ ||||
 +|**change** ​ ^^^^
 +^ |The amount of difference between last and previous values. ​ |  |Supported value types: float, int, str, text, log\\ \\ For example:\\ (previous value;last value=change)\\ 1;5=+4\\ 3;1=-2\\ 0;​-2.5=-2.5\\ \\ For strings returns:\\ 0 - values are equal\\ 1 - values differ ​ |
 +^ ||||
 +|**count** (sec<​nowiki>​|</​nowiki>#​num,<​pattern>,<​operator>,<​time_shift>​) ​ ^^^^
 +^ |Number of values within the defined evaluation period. ​ |**sec** or **#num** - evaluation period in seconds or in latest collected values (preceded by a hash mark)\\ **pattern** (optional) - required pattern\\ \\ **operator** (optional)\\ \\ Supported ''​operators'':​\\ //eq// - equal\\ //ne// - not equal\\ //gt// - greater\\ //ge// - greater or equal\\ //lt// - less\\ //le// - less or equal\\ //like// - matches if contains pattern (case-sensitive)\\ //band// - bitwise AND (supported since Zabbix 2.2.0).\\ \\ Note that:\\ //eq// (default), //ne//, //gt//, //ge//, //lt//, //le//, //band// are supported for integer items\\ //eq// (default), //ne//, //gt//, //ge//, //lt//, //le// are supported for float items\\ //like// (default), //eq//, //ne// are supported for string, text and log items\\ \\ **time_shift** (optional) - see avg()  |Supported value types: float, integer, string, text, log\\ Float items match with the precision of 0.000001.\\ \\ With //band// as third parameter, the second parameter can be specified as two numbers, separated by  '/':​ **number_to_compare_with/​mask**. count() calculates "​bitwise AND" from the value and the //mask// and compares the result to //​number_to_compare_with//​. If the result of "​bitwise AND" is equal to //​number_to_compare_with//,​ the value is counted.\\ If //​number_to_compare_with//​ and //mask// are equal, only the //mask// need be specified (without '/'​).\\ \\ Examples:\\ => count(600) -> number of values for last 10 minutes\\ => %%count(10m,"​error",​eq)%% -> number of values for last 10 minutes that equal '​error'​\\ => count(600,​12) -> number of values for last 10 minutes that equal '​12'​\\ => %%count(600,​12,​gt)%% -> number of values for last 10 minutes that are over '​12'​\\ => %%count(#​10,​12,​gt)%% -> number of values within last 10 values that are over '​12'​\\ => %%count(600,​12,​gt,​86400)%% -> number of values for preceding 10 minutes up to 24 hours ago that were over '​12'​\\ => %%count(600,​6/​7,​band)%% -> number of values for last 10 minutes having '​110'​ (in binary) in the 3 least significant bits.\\ => count(600,,,​86400) -> number of values for preceding 10 minutes up to 24 hours ago\\ \\ The ''#​num''​ parameter is supported since Zabbix 1.6.1.\\ The ''​time_shift''​ parameter and string operators are supported since Zabbix 1.8.2. ​ |
 +^ ||||
 +|**date** ​ ^^^^
 +^ |Current date in YYYYMMDD format. ​ |  |Supported value types: //any//\\ \\ Example of returned value: 20150731 ​  |
 +^ ||||
 +|**dayofmonth** ​ ^^^^
 +^ |Day of month in range of 1 to 31.  |  |Supported value types: //any//\\ \\ This function is supported since Zabbix 1.8.5. ​ |
 +^ ||||
 +|**dayofweek** ​ ^^^^
 +^ |Day of week in range of 1 to 7 (Mon - 1, Sun - 7).  |  |Supported value types: //​any// ​ |
 +^ ||||
 +|**delta** (sec<​nowiki>​|</​nowiki>#​num,<​time_shift>​) ​ ^^^^
 +^ |Difference between the maximum and minimum values within the defined evaluation period ('​max()'​ minus '​min()'​). ​ |**sec** or **#num** - evaluation period in seconds or in latest collected values specified (preceded by a hash mark)\\ **time_shift** (optional) - see avg()  |Supported value types: float, int\\ \\ The ''​time_shift''​ parameter is supported since Zabbix 1.8.2. ​ |
 +^ ||||
 +|**diff** ​ ^^^^
 +^ |Checking if last and previous values differ. ​ |  |Supported value types: float, int, str, text, log\\ \\ Returns:\\ 1 - last and previous values differ\\ 0 - otherwise ​ |
 +^ ||||
 +|**fuzzytime** (sec) ^^^^
 +^ |Checking how much an item timestamp value differs from the Zabbix server time.  |**sec** - seconds ​ |Supported value types: float, int\\ \\ Returns:\\ 0 - if difference between item timestamp value and Zabbix server timestamp is over T seconds\\ 1 - otherwise.\\ \\ Usually used with system.localtime to check that local time is in sync with local time of Zabbix server.\\ Can be used also with vfs.file.time[/​path/​file,​modify] key to check that file didn't get updates for long time.\\ \\ Example:\\ => fuzzytime(60)=0 -> detect a problem if time difference is over 60 seconds ​ |
 +^ ||||
 +|**iregexp** (pattern,<​sec<​nowiki>​|</​nowiki>#​num>​) ​ ^^^^
 +^ |This function is a non case-sensitive analogue of regexp(). ​ |see regexp() ​ |Supported value types: str, log, text  |
 +^ ||||
 +|**last** (sec<​nowiki>​|</​nowiki>#​num,<​time_shift>​) ​ ^^^^
 +^ |The most recent value. ​ |**sec** (ignored) or **#num** - the Nth most recent value\\ **time_shift** (optional) - see avg()  |Supported value types: float, int, str, text, log\\ \\ Take note that ''#​num''​ works differently here than with many other functions.\\ For example:\\ last() is always equal to last(#1)\\ last(#3) - third most recent value (//not// three latest values)\\ \\ Zabbix does not guarantee exact order of values if more than two values exist within one second in history.\\ \\ The ''#​num''​ parameter is supported since Zabbix 1.6.2.\\ The ''​time_shift''​ parameter is supported since Zabbix 1.8.2. ​ |
 +^ ||||
 +|**logeventid** (pattern) ​ ^^^^
 +^ |Check if event ID of the last log entry matches a regular expression. ​ |**pattern** - regular expression describing the required pattern, [[http://​en.wikipedia.org/​wiki/​Regular_expression#​POSIX_Extended_Regular_Expressions|POSIX extended]] style. ​ |Supported value types: log\\ \\ Returns:\\ 0 - does not match\\ 1 - matches\\ \\ This function is supported since Zabbix 1.8.5. ​ |
 +^ ||||
 +|**logseverity** ​ ^^^^
 +^ |Log severity of the last log entry. ​ |  |Supported value types: log\\ \\ Returns:\\ 0 - default severity\\ N - severity (integer, useful for Windows event logs: 1 - Information,​ 2 - Warning, 4 - Error, 7 - Failure Audit, 8 - Success Audit, 9 - Critical, 10 - Verbose).\\ Zabbix takes log severity from **Information** field of Windows event log.  |
 +^ ||||
 +|**logsource** (pattern) ​ ^^^^
 +^ |Checking if log source of the last log entry matches parameter. ​ |**pattern** - required string ​ |Supported value types: log\\ \\ Returns:\\ 0 - does not match\\ 1 - matches\\ Normally used for Windows event logs. For example, %%logsource("​VMware Server"​)%%. ​ |
 +^ ||||
 +|**max** (sec<​nowiki>​|</​nowiki>#​num,<​time_shift>​) ​ ^^^^
 +^ |Highest value of an item within the defined evaluation period. ​ |**sec** or **#num** - evaluation period in seconds or in latest collected values (preceded by a hash mark)\\ **time_shift** (optional) - see avg()  |Supported value types: float, int\\ \\ The ''​time_shift''​ parameter is supported since Zabbix 1.8.2. ​ |
 +^ ||||
 +|**min** (sec<​nowiki>​|</​nowiki>#​num,<​time_shift>​) ​ ^^^^
 +^ |Lowest value of an item within the defined evaluation period. ​ |**sec** or **#num** - evaluation period in seconds or in latest collected values (preceded by a hash mark)\\ **time_shift** (optional) - see avg()  |Supported value types: float, int\\ \\ The ''​time_shift''​ parameter is supported since Zabbix 1.8.2. ​ |
 +^ ||||
 +|**nodata** (sec)  ^^^^
 +^ |Checking for no data received. ​ |**sec** - evaluation period in seconds. The period should not be less than 30 seconds. ​ |Supported value types: //any//\\ \\ Returns:\\ 1 - if no data received during the defined period of time\\ 0 - otherwise\\ \\ Note that this function will display an error if, within the period of the 1st parameter:​\\ - there'​s no data and Zabbix server was restarted\\ - there'​s no data and maintenance was completed\\ - there'​s no data and the item was added or re-enabled\\ Errors are displayed in the //Info// column in trigger [[:​manual/​web_interface/​frontend_sections/​configuration/​hosts/​triggers|configuration]]. ​ |
 +^ ||||
 +|**now** ​ ^^^^
 +^ |Number of seconds since the Epoch (00:00:00 UTC, January 1, 1970). ​ |  |Supported value types: //​any// ​ |
 +^ ||||
 +|**prev** ​ ^^^^
 +^ |Previous value. ​ |  |Supported value types: float, int, str, text, log\\ \\ Returns the same as last(#​2). ​ |
 +^ ||||
 +|**regexp** (pattern,<​sec<​nowiki>​|</​nowiki>#​num>​) ​ ^^^^
 +^ |Checking if the latest (most recent) value matches regular expression. ​ |**pattern** - regular expression, [[http://​en.wikipedia.org/​wiki/​Regular_expression#​POSIX_Extended_Regular_Expressions|POSIX extended]] style.\\ **sec** or **#num** (optional) - evaluation period in seconds or in latest collected values (preceded by a hash mark). In this case, more than one value may be processed. ​ |Supported value types: str, text, log\\ \\ Returns:\\ 1 - found\\ 0 - otherwise\\ \\ This function is case-sensitive. ​ |
 +^ ||||
 +|**str** (pattern,<​sec<​nowiki>​|</​nowiki>#​num>​) ​ ^^^^
 +^ |Finding a string in the latest (most recent) value. ​ |**pattern** - required string\\ **sec** or **#num** (optional) - evaluation period in seconds or in latest collected values (preceded by a hash mark). ​ In this case, more than one value may be processed. ​ |Supported value types: str, text, log\\ \\ Returns:\\ 1 - found\\ 0 - otherwise\\ \\ This function is case-sensitive. ​ |
 +^ ||||
 +|**strlen** (sec<​nowiki>​|</​nowiki>#​num,<​time_shift>​) ​ ^^^^
 +^ |Length of the latest (most recent) value in characters (not bytes). ​ |**sec** (ignored) or **#num** - the Nth most recent value\\ **time_shift** (optional) - see avg()  |Supported value types: str, text, log\\ \\ Take note that ''#​num''​ works differently here than with many other functions.\\ \\ Examples:\\ => strlen()(is equal to strlen(#1)) -> length of the latest value\\ => strlen(#3) -> length of the third most recent value\\ => strlen(,​86400) -> length of the most recent value one day ago.\\ \\ This function is supported since Zabbix 1.8.4. ​ |
 +^ ||||
 +|**sum** (sec<​nowiki>​|</​nowiki>#​num,<​time_shift>​) ​ ^^^^
 +^ |Sum of collected values within the defined evaluation period. ​ |**sec** or **#num** - maximum evaluation period in seconds or in latest collected values (preceded by a hash mark)\\ **time_shift** (optional) - see avg()  |Supported value types: float, int\\ \\ The function is evaluated starting with the first received value.\\ \\ The ''​time_shift''​ parameter is supported since Zabbix 1.8.2. ​ |
 +^ ||||
 +|**time** ​ ^^^^
 +^ |Current time in HHMMSS format. ​ |  |Supported value types: //any//\\ \\ Example of returned value: 123055 ​ |
 +
 +<note important>​1) All functions return numeric values only. Comparison to strings is not supported, for example.\\ 2) Some of the functions cannot be used for non-numeric parameters!\\ 3) String arguments should be double quoted. Otherwise, they might get misinterpreted. ​ </​note>​