Trigger doesnot go away

[pradhanparas]

hi,

I have this trigger

{testsrv:log[/var/log/messages,error].count(30)}>0

. This trigger doesnot go away from Triggers menu after 30 minutes.

What I want is, if "error" is found in the messages log file, it should report and after 30 minutes that trigger should vanish from the triggers page.

What did I miss?

Thanks
Paras.

[heaje]

I can't speak for exactly why the trigger isn't going away after 30 minutes, but I'm surprised it lasts even past 30 seconds. The first parameter for the count function is the time in seconds.

If you want that trigger to do what you said (that is, stay live for 30 minutes), you'll need to change "count(30)" to "count(1800)".

You can see the count function info in the docs here (assuming you are running 2.0.x):
http://www.zabbix.com/documentation/...gers/functions

[jerrylenk]

Have you had a look at the "Latest data" history that the log item reports?

I had a similar issue with a trapper item and trigger:
Apparently, the trigger expression is not evaluated again until new data arrives on the item. Thus, if it doesn't "count" until there is one more, it will never find zero values. ;-)

You could try setting up another calculated item with your "log-item".count(1800) expression, re-counting every some minutes.
Then make your trigger check this item, so it will evaluate every some minutes, too.

Greetings, Jerry

[jerrylenk]

Correction

In a calculated item, the expression should look like:

count(<other item key>, time)

unlike the trigger expression item.key[...].count(time).

[pradhanparas]

Jerrylenk,

Thanks for your reply.

This is what I have now

Item (zabbix agent active): log[/var/log/messages,error]

Trigger: {Template OS Linux:log[/var/log/messages,error].count(1800)}>0

Now how does one create the calculated item as you have mentioned?

Thanks
Paras.

[jerrylenk]

I've tried this out...
It took some trials and errors to figure out all that quoting in the formula .
Obviously, my logfile is an other. Note how the inner "" must be escaped with backslashes. Also, even in windows paths / works instead of \.


You can call the key anything you like. (I got a typo!)

The new Trigger would then be:
{Example:synclogerrrors.count.last(0)} >0

greetings, Jerry

[pradhanparas]

Thanks for the instructions.

This is my item expression:

name: logerrors
count(log["/var/log/messages",error],1800)

and trigger

logerrrors.count.last(0)} >0

The items is greyed out in Latest data and I see the following in log server log file

[hostname:logerrors.count] became not supported: Cannot evaluate function [count(error],1800)]: item [hostname:log[/var/log/messages] not found


Any ideas?

Thanks
Paras.

[jerrylenk]

Hi Paras,

yea, exactly what I got at first. That's what I mean by, it took some trial and error
Try:
count("log[\"/var/log/messages\",error]",1800)

Because otherwise, the count function stumbles at the first comma, I suppose.


But:
I found a much easier way:
Trigger {Template OS Linux:log[/var/log/messages,error].nodata(1800)} =0

nodata = 0 means, there is data.
And the nodata() function is periodically recalculated, other than the count() function.

So long!

[pradhanparas]

Jerrylnk,

using .nodata() worked. Thanks a lot. Really appreciate it.

Paras.