This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision
Previous revision
manual:config:triggers [2014/09/26 11:28]
sasha Links adapted because of a move operation
manual:config:triggers [2021/10/01 11:46] (current)
martins-v wording fix
Line 1: Line 1:
-===== - #3 Triggers =====+===== 3 Triggers =====
 === Overview === === Overview ===
Line 12: Line 12:
-|OK     ​|This is a normal trigger state. ​Called FALSE in older Zabbix versions.+|OK       ​|This is a normal trigger state. ​ 
-|PROBLEM|Normally means that something happened. For example, the processor load is too high. Called TRUE in older Zabbix versions.|+|PROBLEM ​ |Normally means that something happened. For example, the processor load is too high.  |
-Trigger status (the expression) is recalculated every time Zabbix server receives ​new value that is part of the expression+In basic trigger we may want to set a threshold for a five minute average ​of some data, for example, ​the CPU loadThis is accomplished by defining a trigger expression where:
-If time-based functions (**nodata()**,​ **date()**, **dayofmonth()**,​ **dayofweek()**,​ **time()**, **now()**) are used in the expression, ​the trigger is recalculated every 30 seconds by a Zabbix //timer// process. If both time-based and non-time-based functions are used in an expression, it is recalculated when a new value is received **and** every 30 seconds. ​+  ​we apply the '​avg'​ function to the value received ​in the item key 
 +  ​we use a five minute period for evaluation 
 +  ​we set a threshold of '​2'​
-You can [[manual:​config:​triggers:​expression|build trigger expressions]] with different degrees of complexity.+  avg(host/​key,​5m)>​2
 +This trigger will "​fire"​ (become PROBLEM) if the five-minute average is over 2. 
 +In a more complex trigger, the expression may include a **combination** of multiple functions and multiple thresholds. See also: [[:​manual/​config/​triggers/​expression|Trigger expression]].
 +Most trigger functions are evaluated based on [[:​manual/​config/​items/​history_and_trends|history]] data, while some trigger functions for long-term analytics, e.g. **trendavg()**,​ **trendcount()**,​ etc, use trend data.
 +=== Calculation time ===
 +A trigger is recalculated every time Zabbix server receives a new value that is part of the expression. When a new value is received, each function that is included in the expression is recalculated (not just the one that received the new value).
 +Additionally,​ a trigger is recalculated each time when a new value is received **and** every 30 seconds if time-based functions are used in the expression. ​
 +Time-based functions are **nodata()**,​ **date()**, **dayofmonth()**,​ **dayofweek()**,​ **time()**, **now()**); they are recalculated every 30 seconds by the Zabbix history syncer process.
 +=== Evaluation period ===
 +An evaluation period is used in functions referencing the item history. It allows to specify the interval we are interested in. It can be specified as time period (30s, 10m, 1h) or as a value range (#5 - for five latest values).
 +The evaluation period is measured up to %%"​now"​ - where "​now"​%% is the latest recalculation time of the trigger (see [[#​calculation_time|Calculation time]] above); %%"​now"​ is not the "​now"​%% time of the server.
 +The evaluation period specifies either:
 +  * To consider all values between %%"​now-time period"​ and  "​now"​ (or, with time shift, between "​now-time shift-time period"​ and "​now-time_shift"​%%)
 +  * To consider no more than the num count of values from the past, up to %%"​now"​%%
 +    * If there are 0 available values for the time period or num count specified - then the trigger or calculated item that uses this function becomes unsupported
 +Note that:
 +  * If only a single function (referencing data history) is used in the trigger, "​now"​ is always the latest received value. For example, if the last value was received an hour ago, the evaluation period will be regarded as up to the latest value an hour ago.
 +  * A new trigger is calculated as soon as the first value is received (history functions); it will be calculated within 30 seconds for time-based functions. Thus the trigger will be calculated even though perhaps the set evaluation period (for example, one hour) has not yet passed since the trigger was created. The trigger will also be calculated after the first value, even though the evaluation range was set, for example, to ten latest values.