Recovery expression not triggering with tag matched OK Event

[Martin Law]

Hi Everyone,

We are having an issue with tag based recovery expressions(Trigger based Event correlation) and i cannot figure out why this is not working.

We have 2 items on a host wich is populated by SNMP trap data (Device Reachable & Device Unreachable).

When we configure 2 triggers (1 for each item) with event tags (named with reg-ex values) to create unique tag for each device/interface it works fine. (so 1 trigger for Reachable and 1 for unreachable).
When i add a recovery expression to the trigger 'Unreachable' to recover if the device is reachable again, with the exact same recovery expression as in the seperate 'Device Reachable' trigger, this does not resolve the event.




So, my question is, why does the same expression work in 1 seperate trigger, and not in the second trigger as a recovery expression. Is this a misconfiguration on our part, does the recovery expression not create/compare tags or is something else wrong?
We are running Zabbix 5.4.7

[ISiroshtan]

Actually it has nothing to do with trigger based event correlation. It's just misunderstanding of how recovery expression operates (I myself had same issue).

Recovery expression is only evaluated AFTER the trigger expression results in FALSE. In your case trigger expression evaluates value X and recovery expression evaluates value Y. So for it to work, you need to receive a new message for Item X('sLost') and only then recovery expression will be evaluated and look what is the value of item Y("sEstablished") and if it satisfies criteria (which might have been overwritten by new messages by that time).

To make it work via single trigger, you'd need to combine 2 Traps into single item (which is possible, as snmptrap[] item uses regex for traps grouping).

Hope it helps mate.

[ISiroshtan]

Actually it has nothing to do with trigger based event correlation. It's just misunderstanding of how recovery expression operates (I myself had same issue).

Recovery expression is only evaluated AFTER the trigger expression results in FALSE. In your case trigger expression evaluates value X and recovery expression evaluates value Y. So for it to work, you need to receive a new message for Item X('sLost') and only then recovery expression will be evaluated and look what is the value of item Y("sEstablished") and if it satisfies criteria (which might have been overwritten by new messages by that time).

To make it work via single trigger, you'd need to combine 2 Traps into single item (which is possible, as snmptrap[] item uses regex for traps grouping).

Hope it helps mate.

[Martin Law]

Hi @ISiroshtan, thanks for the tip. I will try it out and i'll post an update on the results.

[Martin Law]

@ISiroshtan, it worked. thanks!