Triggers are logical expressions that "evaluate" data gathered by items and represent the current system state.
While items are used to gather system data, it is highly impractical to follow these data all the time waiting for a condition that is alarming or deserves attention. The job of "evaluating" data can be left to trigger expressions.
Trigger expressions allow to define a threshold of what state of data is "acceptable". Therefore, should the incoming data surpass the acceptable state, a trigger is "fired" - or changes its state to PROBLEM.
A trigger may have the following states:
|OK||This is a normal trigger state.|
|Problem||Something has happened. For example, the processor load is too high.|
|Unknown||The trigger value cannot be calculated. See Unknown state.|
In a simple trigger we may want to set a threshold for a five-minute average of some data, for example, the CPU load. This is accomplished by defining a trigger expression where:
This trigger will "fire" (become PROBLEM) if the five-minute average is over 2.
In a more complex trigger, the expression may include a combination of multiple functions and multiple thresholds. See also: Trigger expression.
After enabling a trigger (changing its configuration status from Disabled to Enabled), the trigger expression is evaluated as soon as an item in it receives a value or the time to handle a time-based function comes.
Most trigger functions are evaluated based on item value history data, while some trigger functions for long-term analytics, e.g. trendavg(), trendcount(), etc, use trend data.
A trigger is recalculated every time Zabbix server receives a new value that is part of the expression. When a new value is received, each function that is included in the expression is recalculated (not just the one that received the new value).
Additionally, a trigger is recalculated each time when a new value is received and every 30 seconds if time-based functions are used in the expression.
Time-based functions are nodata(), date(), dayofmonth(), dayofweek(), time(), now(); they are recalculated every 30 seconds by the Zabbix history syncer process.
Triggers that reference trend functions only are evaluated once per the smallest time period in the expression. See also trend functions.
An evaluation period is used in functions referencing the item history. It allows to specify the interval we are interested in. It can be specified as time period (30s, 10m, 1h) or as a value range (#5 - for five latest values).
The evaluation period is measured up to "now" - where "now" is the latest recalculation time of the trigger (see Calculation time above); "now" is not the "now" time of the server.
The evaluation period specifies either:
It is possible that an unknown operand appears in a trigger expression if:
In this case a trigger generally evaluates to "unknown" (although there are some exceptions). For more details, see Expressions with unknown operands.
It is possible to get notified on unknown triggers.