This is an old revision of the document!
Sometimes there are signs of the upcoming problem. These signs can be spotted so that actions may be taken in advance to prevent or at least minimize the impact of the problem. Zabbix has tools to predict the future behaviour of the monitored system based on historic data.
Two things one needs to know is how to define a problem state and how much time is needed to take action. Then there are two ways to set up a trigger signalling about a potential unwanted situation. First: trigger must fire when system after “time to act” is expected to be in problem state. Second: trigger must fire when system is going to reach the problem state in less than “time to act”. Corresponding trigger functions to use are forecast and timeleft. Note that underlying statistical analysis is basically identical for both functions. You may set up a trigger whichever way you prefer with similar results.
Both functions use almost the same set of parameters. Use the list of supported functions for reference.
First of all you should specify the historic period Zabbix should analyse to come up with prediction. You do it in a familiar way by means of sec
or #num
parameter and optional time_shift
like you do it with avg, count, delta, max, min and sum functions.
(forecast only)
Parameter time
specifies how far in the future Zabbix should extrapolate dependencies it finds in historic data. No matter if you use time_shift
or not, time
is always counted starting from the current moment.
(timeleft only)
Parameter threshold
specifies a value the analysed item has to reach, no difference if from above or from below. Once we have determined f(t) (see below) we should solve equation f(t) = threshold
and return the root which is closer to now and to the right from now or 999999999999.9999 if there is no such root.
Default fit
is the linear function. But if your monitored system is more complicated you have more options to choose from.
fit | x = f(t) |
---|---|
linear | x = a + b*t |
polynomialN1) | x = a0 + a1*t + a2*t2 + … + an*tn |
exponential | x = a*exp(b*t) |
logarithmic | x = a + b*log(t) |
power | x = a*tb |
(forecast only)
Every time a trigger function is evaluated it gets data from the specified history period and fits a specified function to the data. So, if the data is slightly different the fitted function will be slightly different. If we simply calculate the value of the fitted function at a specified time in the future you will know nothing about how the analysed item is expected to behave between now and that moment in the future. For some fit
options (like polynomial) a simple value from the future may be misleading.
mode | forecast result |
---|---|
value | f(now + time ) |
max | maxnow <= t <= now + time f(t) |
min | minnow <= t <= now + time f(t) |
delta | max - min |
avg | average of f(t) (now <= t <= now + time ) according to definition |
To avoid calculations with huge numbers we consider the timestamp of the first value in specified period plus 1 ns as a new zero-time (current epoch time is of order 109, epoch squared is 1018, double precision is about 10-16). 1 ns is added to provide all positive time values for logarithmic and power fits which involve calculating log(t). Time shift does not affect linear, polynomial, exponential (apart from easier and more precise calculations) but changes the shape of logarithmic and power functions.
Functions return -1 in such situations:
Note: No warnings or errors are flagged if chosen fit poorly describes provided data or there is just too few data for accurate prediction.