Zabbix Documentation 2.4

3.04.04.2 (current)In development:4.4 (devel)Unsupported:1.82.02.22.43.23.4

User Tools

Site Tools


manual:appendix:triggers:functions

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
manual:appendix:triggers:functions [2019/07/09 08:59]
martins-v old revision restored (2019/07/08 05:32)
manual:appendix:triggers:functions [2019/07/09 09:04] (current)
martins-v these functions are evaluated starting with the first received value
Line 9: Line 9:
 ^ |||| ^ ||||
 |**avg** (sec<​nowiki>​|</​nowiki>#​num,<​time_shift>​) ​ ^^^^ |**avg** (sec<​nowiki>​|</​nowiki>#​num,<​time_shift>​) ​ ^^^^
-^ |Average value of an item within the defined evaluation period. ​ |**sec** or **#num** - evaluation period in seconds or in latest collected values (preceded by a hash mark)\\ **time_shift** (optional) - evaluation point is moved the number of seconds back in time  |Supported value types: float, int\\ \\ Examples:\\ => avg(#5) -> average value for the five latest values\\ => avg(3600) -> average value for an hour\\ => avg(3600,​86400) -> average value for an hour one day ago.\\ \\ The ''​time_shift''​ parameter is supported since Zabbix 1.8.2. It is useful when there is a need to compare the current average value with the average value time_shift seconds back.  |+^ |Average value of an item within the defined evaluation period. ​ |**sec** or **#num** - maximum ​evaluation period<​sup>​**[[#​footnotes|1]]**</​sup> ​in seconds or in latest collected values (preceded by a hash mark)\\ **time_shift** (optional) - evaluation point is moved the number of seconds back in time  |Supported value types: float, int\\ \\ Examples:\\ => avg(#5) -> average value for the five latest values\\ => avg(3600) -> average value for an hour\\ => avg(3600,​86400) -> average value for an hour one day ago.\\ \\ The ''​time_shift''​ parameter is supported since Zabbix 1.8.2. It is useful when there is a need to compare the current average value with the average value time_shift seconds back.  |
 ^ |||| ^ ||||
 |**band** (sec<​nowiki>​|</​nowiki>#​num,​mask,<​time_shift>​) ​ ^^^^ |**band** (sec<​nowiki>​|</​nowiki>#​num,​mask,<​time_shift>​) ​ ^^^^
Line 18: Line 18:
 ^ |||| ^ ||||
 |**count** (sec<​nowiki>​|</​nowiki>#​num,<​pattern>,<​operator>,<​time_shift>​) ​ ^^^^ |**count** (sec<​nowiki>​|</​nowiki>#​num,<​pattern>,<​operator>,<​time_shift>​) ​ ^^^^
-^ |Number of values within the defined evaluation period. ​ |**sec** or **#num** - evaluation period in seconds or in latest collected values (preceded by a hash mark)\\ **pattern** (optional) - required pattern\\ \\ **operator** (optional)\\ \\ Supported ''​operators'':​\\ //eq// - equal\\ //ne// - not equal\\ //gt// - greater\\ //ge// - greater or equal\\ //lt// - less\\ //le// - less or equal\\ //like// - matches if contains pattern (case-sensitive)\\ //band// - bitwise AND (supported since Zabbix 2.2.0).\\ \\ Note that:\\ //eq// (default), //ne//, //gt//, //ge//, //lt//, //le//, //band// are supported for integer items\\ //eq// (default), //ne//, //gt//, //ge//, //lt//, //le// are supported for float items\\ //like// (default), //eq//, //ne// are supported for string, text and log items\\ \\ **time_shift** (optional) - see avg()  |Supported value types: float, integer, string, text, log\\ Float items match with the precision of 0.000001.\\ \\ With //band// as third parameter, the second parameter can be specified as two numbers, separated by  '/':​ **number_to_compare_with/​mask**. count() calculates "​bitwise AND" from the value and the //mask// and compares the result to //​number_to_compare_with//​. If the result of "​bitwise AND" is equal to //​number_to_compare_with//,​ the value is counted.\\ If //​number_to_compare_with//​ and //mask// are equal, only the //mask// need be specified (without '/'​).\\ \\ Examples:\\ => count(600) -> number of values for last 10 minutes\\ => %%count(10m,"​error",​eq)%% -> number of values for last 10 minutes that equal '​error'​\\ => count(600,​12) -> number of values for last 10 minutes that equal '​12'​\\ => %%count(600,​12,​gt)%% -> number of values for last 10 minutes that are over '​12'​\\ => %%count(#​10,​12,​gt)%% -> number of values within last 10 values that are over '​12'​\\ => %%count(600,​12,​gt,​86400)%% -> number of values for preceding 10 minutes up to 24 hours ago that were over '​12'​\\ => %%count(600,​6/​7,​band)%% -> number of values for last 10 minutes having '​110'​ (in binary) in the 3 least significant bits.\\ => count(600,,,​86400) -> number of values for preceding 10 minutes up to 24 hours ago\\ \\ The ''#​num''​ parameter is supported since Zabbix 1.6.1.\\ The ''​time_shift''​ parameter and string operators are supported since Zabbix 1.8.2. ​ |+^ |Number of values within the defined evaluation period. ​ |**sec** or **#num** - maximum ​evaluation period<​sup>​**[[#​footnotes|1]]**</​sup> ​in seconds or in latest collected values (preceded by a hash mark)\\ **pattern** (optional) - required pattern\\ \\ **operator** (optional)\\ \\ Supported ''​operators'':​\\ //eq// - equal\\ //ne// - not equal\\ //gt// - greater\\ //ge// - greater or equal\\ //lt// - less\\ //le// - less or equal\\ //like// - matches if contains pattern (case-sensitive)\\ //band// - bitwise AND (supported since Zabbix 2.2.0).\\ \\ Note that:\\ //eq// (default), //ne//, //gt//, //ge//, //lt//, //le//, //band// are supported for integer items\\ //eq// (default), //ne//, //gt//, //ge//, //lt//, //le// are supported for float items\\ //like// (default), //eq//, //ne// are supported for string, text and log items\\ \\ **time_shift** (optional) - see avg()  |Supported value types: float, integer, string, text, log\\ Float items match with the precision of 0.000001.\\ \\ With //band// as third parameter, the second parameter can be specified as two numbers, separated by  '/':​ **number_to_compare_with/​mask**. count() calculates "​bitwise AND" from the value and the //mask// and compares the result to //​number_to_compare_with//​. If the result of "​bitwise AND" is equal to //​number_to_compare_with//,​ the value is counted.\\ If //​number_to_compare_with//​ and //mask// are equal, only the //mask// need be specified (without '/'​).\\ \\ Examples:\\ => count(600) -> number of values for last 10 minutes\\ => %%count(10m,"​error",​eq)%% -> number of values for last 10 minutes that equal '​error'​\\ => count(600,​12) -> number of values for last 10 minutes that equal '​12'​\\ => %%count(600,​12,​gt)%% -> number of values for last 10 minutes that are over '​12'​\\ => %%count(#​10,​12,​gt)%% -> number of values within last 10 values that are over '​12'​\\ => %%count(600,​12,​gt,​86400)%% -> number of values for preceding 10 minutes up to 24 hours ago that were over '​12'​\\ => %%count(600,​6/​7,​band)%% -> number of values for last 10 minutes having '​110'​ (in binary) in the 3 least significant bits.\\ => count(600,,,​86400) -> number of values for preceding 10 minutes up to 24 hours ago\\ \\ The ''#​num''​ parameter is supported since Zabbix 1.6.1.\\ The ''​time_shift''​ parameter and string operators are supported since Zabbix 1.8.2. ​ |
 ^ |||| ^ ||||
 |**date** ​ ^^^^ |**date** ​ ^^^^
Line 30: Line 30:
 ^ |||| ^ ||||
 |**delta** (sec<​nowiki>​|</​nowiki>#​num,<​time_shift>​) ​ ^^^^ |**delta** (sec<​nowiki>​|</​nowiki>#​num,<​time_shift>​) ​ ^^^^
-^ |Difference between the maximum and minimum values within the defined evaluation period ('​max()'​ minus '​min()'​). ​ |**sec** or **#num** - evaluation period in seconds or in latest collected values specified (preceded by a hash mark)\\ **time_shift** (optional) - see avg()  |Supported value types: float, int\\ \\ The ''​time_shift''​ parameter is supported since Zabbix 1.8.2. ​ |+^ |Difference between the maximum and minimum values within the defined evaluation period ('​max()'​ minus '​min()'​). ​ |**sec** or **#num** - maximum ​evaluation period<​sup>​**[[#​footnotes|1]]**</​sup> ​in seconds or in latest collected values specified (preceded by a hash mark)\\ **time_shift** (optional) - see avg()  |Supported value types: float, int\\ \\ The ''​time_shift''​ parameter is supported since Zabbix 1.8.2. ​ |
 ^ |||| ^ ||||
 |**diff** ​ ^^^^ |**diff** ​ ^^^^
Line 54: Line 54:
 ^ |||| ^ ||||
 |**max** (sec<​nowiki>​|</​nowiki>#​num,<​time_shift>​) ​ ^^^^ |**max** (sec<​nowiki>​|</​nowiki>#​num,<​time_shift>​) ​ ^^^^
-^ |Highest value of an item within the defined evaluation period. ​ |**sec** or **#num** - evaluation period in seconds or in latest collected values (preceded by a hash mark)\\ **time_shift** (optional) - see avg()  |Supported value types: float, int\\ \\ The ''​time_shift''​ parameter is supported since Zabbix 1.8.2. ​ |+^ |Highest value of an item within the defined evaluation period. ​ |**sec** or **#num** - maximum ​evaluation period<​sup>​**[[#​footnotes|1]]**</​sup> ​in seconds or in latest collected values (preceded by a hash mark)\\ **time_shift** (optional) - see avg()  |Supported value types: float, int\\ \\ The ''​time_shift''​ parameter is supported since Zabbix 1.8.2. ​ |
 ^ |||| ^ ||||
 |**min** (sec<​nowiki>​|</​nowiki>#​num,<​time_shift>​) ​ ^^^^ |**min** (sec<​nowiki>​|</​nowiki>#​num,<​time_shift>​) ​ ^^^^
-^ |Lowest value of an item within the defined evaluation period. ​ |**sec** or **#num** - evaluation period in seconds or in latest collected values (preceded by a hash mark)\\ **time_shift** (optional) - see avg()  |Supported value types: float, int\\ \\ The ''​time_shift''​ parameter is supported since Zabbix 1.8.2. ​ |+^ |Lowest value of an item within the defined evaluation period. ​ |**sec** or **#num** - maximum ​evaluation period<​sup>​**[[#​footnotes|1]]**</​sup> ​in seconds or in latest collected values (preceded by a hash mark)\\ **time_shift** (optional) - see avg()  |Supported value types: float, int\\ \\ The ''​time_shift''​ parameter is supported since Zabbix 1.8.2. ​ |
 ^ |||| ^ ||||
 |**nodata** (sec)  ^^^^ |**nodata** (sec)  ^^^^
Line 69: Line 69:
 ^ |||| ^ ||||
 |**regexp** (pattern,<​sec<​nowiki>​|</​nowiki>#​num>​) ​ ^^^^ |**regexp** (pattern,<​sec<​nowiki>​|</​nowiki>#​num>​) ​ ^^^^
-^ |Checking if the latest (most recent) value matches regular expression. ​ |**pattern** - regular expression, [[http://​en.wikipedia.org/​wiki/​Regular_expression#​POSIX_Extended_Regular_Expressions|POSIX extended]] style.\\ **sec** or **#num** (optional) - evaluation period in seconds or in latest collected values (preceded by a hash mark). In this case, more than one value may be processed. ​ |Supported value types: str, text, log\\ \\ Returns:\\ 1 - found\\ 0 - otherwise\\ \\ This function is case-sensitive. ​ |+^ |Checking if the latest (most recent) value matches regular expression. ​ |**pattern** - regular expression, [[http://​en.wikipedia.org/​wiki/​Regular_expression#​POSIX_Extended_Regular_Expressions|POSIX extended]] style.\\ **sec** or **#num** (optional) - maximum ​evaluation period<​sup>​**[[#​footnotes|1]]**</​sup> ​in seconds or in latest collected values (preceded by a hash mark). In this case, more than one value may be processed. ​ |Supported value types: str, text, log\\ \\ Returns:\\ 1 - found\\ 0 - otherwise\\ \\ This function is case-sensitive. ​ |
 ^ |||| ^ ||||
 |**str** (pattern,<​sec<​nowiki>​|</​nowiki>#​num>​) ​ ^^^^ |**str** (pattern,<​sec<​nowiki>​|</​nowiki>#​num>​) ​ ^^^^
-^ |Finding a string in the latest (most recent) value. ​ |**pattern** - required string\\ **sec** or **#num** (optional) - evaluation period in seconds or in latest collected values (preceded by a hash mark). ​ In this case, more than one value may be processed. ​ |Supported value types: str, text, log\\ \\ Returns:\\ 1 - found\\ 0 - otherwise\\ \\ This function is case-sensitive. ​ |+^ |Finding a string in the latest (most recent) value. ​ |**pattern** - required string\\ **sec** or **#num** (optional) - maximum ​evaluation period<​sup>​**[[#​footnotes|1]]**</​sup> ​in seconds or in latest collected values (preceded by a hash mark). ​ In this case, more than one value may be processed. ​ |Supported value types: str, text, log\\ \\ Returns:\\ 1 - found\\ 0 - otherwise\\ \\ This function is case-sensitive. ​ |
 ^ |||| ^ ||||
 |**strlen** (sec<​nowiki>​|</​nowiki>#​num,<​time_shift>​) ​ ^^^^ |**strlen** (sec<​nowiki>​|</​nowiki>#​num,<​time_shift>​) ​ ^^^^
Line 78: Line 78:
 ^ |||| ^ ||||
 |**sum** (sec<​nowiki>​|</​nowiki>#​num,<​time_shift>​) ​ ^^^^ |**sum** (sec<​nowiki>​|</​nowiki>#​num,<​time_shift>​) ​ ^^^^
-^ |Sum of collected values within the defined evaluation period. ​ |**sec** or **#num** - maximum evaluation period in seconds or in latest collected values (preceded by a hash mark)\\ **time_shift** (optional) - see avg()  |Supported value types: float, int\\ \\ The function is evaluated starting with the first received value.\\ \\ The ''​time_shift''​ parameter is supported since Zabbix 1.8.2. ​ |+^ |Sum of collected values within the defined evaluation period. ​ |**sec** or **#num** - maximum evaluation period<​sup>​**[[#​footnotes|1]]**</​sup> ​in seconds or in latest collected values (preceded by a hash mark)\\ **time_shift** (optional) - see avg()  |Supported value types: float, int\\ \\ The function is evaluated starting with the first received value.\\ \\ The ''​time_shift''​ parameter is supported since Zabbix 1.8.2. ​ |
 ^ |||| ^ ||||
 |**time** ​ ^^^^ |**time** ​ ^^^^
 ^ |Current time in HHMMSS format. ​ |  |Supported value types: //any//\\ \\ Example of returned value: 123055 ​ | ^ |Current time in HHMMSS format. ​ |  |Supported value types: //any//\\ \\ Example of returned value: 123055 ​ |
  
-<​note ​important>1) All functions return numeric values only. Comparison to strings is not supported, for example.\\ 2) Some of the functions cannot be used for non-numeric ​parameters!\\ 3) String arguments should be double quoted. Otherwise, they might get misinterpreted. ​ </​note>​+<​note ​warning>Important notes:\\ **1)** All functions return numeric values only. Comparison to strings is not supported.\\ ​**2)** Some of the functions cannot be used for non-numeric ​values!\\ **3)** String arguments should be double quoted. Otherwise, they might get misinterpreted.\\ **4)** For all trigger functions **sec** and **time_shift** must be an integer with an optional [[manual:​config:​triggers:​suffixes#​trigger_expressions|time unit suffix]] and has absolutely nothing to do with the item's data type.</​note>​ 
 + 
 +== Footnotes == 
 + 
 +<​sup>​**1**</​sup>​ The function is evaluated starting with the first received value (unless the ''​timeshift''​ parameter is used).