Alerts need to be sent only after x minutes

[edeus]

Hello,

I have alerts currently setup to send email/sms if a trigger goes off. Triggers currently are set to very flexible values but cannot be made any "looser". I.e. Host not responding, has to be at least 2 minutes down.

Is there a way to setup alerts OR media's to only send a message if it has been down for a different period of time? This would be VERY useful as then I could get a decent night's sleep without waking up to beeping in the middle of the night for a 5 minute "flap".

The only other solution I can think of is a script hack or two sets of triggers. Both solutions are workarounds though.

Thanks for any input.

[bbrendon]

check the trigger functions. i use nodata(910) to determine a host is down for active checks. For regular agents, there is probably a better way. get creative

[edeus]

Not sure if I wasnt clear or just misunderstood, but basically i am looking for a way to have a variable alert "wait x minutes before send" options.

With this, after hours (6-7,00:00-23:59) needs to be triggered for at least x minutes. This way false positives will not send me sms'es needlessly.

Currently the triggers only go off after 2 minutes of being "ON" which is perfect for office hour monitoring when I am not sleeping or on holidays. But when its night time, ISP's often do work in the early hours. This can be anywhere between 5-30 minutes of downtime (on average 1 in 30 will go down over a night). The server usually comes back up without intervention, in this case I dont need to do anything. No need to be woken up at 2AM. If the Alert could send after a longer time than the default trigger time, it would let me get some sleep.

Hope this makes sense.

[cameronsto]

Zabbix provides many different trigger functions which let you examine data over a certain amount of time. For example, 'sum' let's you test the sum of an item over a specified number of seconds. You could specify an allowable sum of values over 5 minutes, and then trigger off of that.

-cameron

[bbrendon]

Not sure if I wasnt clear or just misunderstood, but basically i am looking for a way to have a variable alert "wait x minutes before send" options.

Trigger functions allow this.

With this, after hours (6-7,00:00-23:59) needs to be triggered for at least x minutes. This way false positives will not send me sms'es needlessly.

Currently the triggers only go off after 2 minutes of being "ON" which is perfect for office hour monitoring when I am not sleeping or on holidays. But when its night time, ISP's often do work in the early hours. This can be anywhere between 5-30 minutes of downtime (on average 1 in 30 will go down over a night). The server usually comes back up without intervention, in this case I dont need to do anything. No need to be woken up at 2AM. If the Alert could send after a longer time than the default trigger time, it would let me get some sleep.

It sounds like I understand what you're looking to do. I don't think you've closely examined the trigger functions. Use the trigger functions to wait longer before "triggering". You can combine the time functions with the sum,nodata,max,etc functions to get the effect you're describing.

There isn't a built in mechinsm that says, "wait for the all the triggers i've configured to be active for 10 minutes before alerting" ... you have to config each trigger individually to do this.

[edeus]

Thanks, I see what your saying.

I guess I wanted to avoid having long triggers dependant on multiple items - as I have had bad experiences in the past (the more items and non standard types, the more chance the trigger would fail).

I can see the following working for a standard host down situation, and it isnt as messy and I would have thought - but it still is overly complex IMHO:

({HOST:icmpping.max(1800)}=0)&
({zabbix:system[procload].time(0)}>000000)& ({zabbix:system[procload].time(0)}<060000)
|
({HOST:icmpping.max(1800)}=0)&
({zabbix:system[procload].time(0)}>180000)& ({zabbix:system[procload].time(0)}<235999)
|
({HOST:icmpping.max(180)}=0)&
({zabbix:system[procload].time(0)}>060000)& ({zabbix:system[procload].time(0)}<180000)

Thanks for everyone's help, it wasnt what I was looking for but it definitely does the trick.

One final question though, there is no "<=" or "=>" operators are there? i.e. what happens at the time barriers such as 000000, 060000, etc. Do I need to offset by -1?