2022 Zabbix中国峰会
2022 Zabbix中国峰会

3 触发器

概述

触发器是“评估”由监控项采集的数据并表示当前系统状况的逻辑表达式。

当监控项用于采集系统的数据时,始终遵循这些数据是非常不切合实际的,因为这些数据始终在等待一个令人担忧或者值得关注的状态。然而这个“评估”数据的工作可以留给触发器表达式。

触发器表达式允许定义一个什么状况的数据是“可接受”的阈值。因此,如果接收的数据超过了可接受的状态,则触发器会被触发 - 或将状态更改为异常。

一个触发器可以拥有下面几种状态:

OK 这是一个正常的触发器状态。在旧版本的Zabbix中称为FALSE。
PROBLEM 通常意味着发生了某些事情。例如,处理器的负载较高。在旧版本的Zabbix中称为TRUE。

每当Zabbix server接收到作为表达式一部分的新值时,都会重新计算触发器状态(表达式)。

如果在表达式中使用基于时间的函数(nodata(), date(), dayofmonth(), dayofweek(), time(), now()),触发器就会由Zabbix history syncer进程每30秒重新计算一次。如果在表达式中同时使用基于时间和非基于时间的函数,当接收到一个新值和每隔30秒都会重新计算触发器的状态。

你可以构建触不同复杂程度的触发器表达式

Calculation time

A trigger is recalculated every time Zabbix server receives a new value that is part of the expression. When a new value is received, each function that is included in the expression is recalculated (not just the one that received the new value).

Additionally, a trigger is recalculated each time when a new value is received and every 30 seconds if time-based functions are used in the expression.

Time-based functions are nodata(), date(), dayofmonth(), dayofweek(), time(), now()); they are recalculated every 30 seconds by the Zabbix history syncer process.

Evaluation period

An evaluation period is used in functions referencing the item history. It allows to specify the interval we are interested in. It can be specified as time period (30s, 10m, 1h) or as a value range (#5 - for five latest values).

The evaluation period is measured up to "now" - where "now" is the latest recalculation time of the trigger (see Calculation time above); "now" is not the "now" time of the server.

The evaluation period specifies either:

  • To consider all values between "now-time period" and "now" (or, with time shift, between "now-time shift-time period" and "now-time_shift")
  • To consider no more than the num count of values from the past, up to "now"
    • If there are 0 available values for the time period or num count specified - then the trigger or calculated item that uses this function becomes unsupported

Note that:

  • If only a single function (referencing data history) is used in the trigger, "now" is always the latest received value. For example, if the last value was received an hour ago, the evaluation period will be regarded as up to the latest value an hour ago.
  • A new trigger is calculated as soon as the first value is received (history functions); it will be calculated within 30 seconds for time-based functions. Thus the trigger will be calculated even though perhaps the set evaluation period (for example, one hour) has not yet passed since the trigger was created. The trigger will also be calculated after the first value, even though the evaluation range was set, for example, to ten latest values.