Problems with trigger .last(#num) function

[nms_user]

Hello all,

I'm trying to use Zabbix' new (documentation tells since v1.6.2) trigger function .last(#num) which doesn't work for me.

The triggers are defined as follows for example:
({ServerHost:net.tcp.port[{IPADDRESS},1433].last(#1)}=0) & ({ServerHost:net.tcp.port[{IPADDRESS},1433].last(#2)}=0) & ({ServerHost:net.tcp.port[{IPADDRESS},1433].last(#3)}=0)

So this trigger should fire only if the last 3 checks were zero (0). But in reality the trigger fires when only one value changes to 0.

Here the values:
2009.Feb.03 15:05:13 Up (1)
2009.Feb.03 15:04:43 Up (1)
2009.Feb.03 15:04:13 Up (1)
2009.Feb.03 15:03:43 Up (1)
2009.Feb.03 15:03:14 Up (1)
2009.Feb.03 15:02:45 Up (1)
2009.Feb.03 15:02:13 Up (1)
2009.Feb.03 15:01:43 Down (0) <-- Trigger fires!
2009.Feb.03 15:01:13 Up (1)
2009.Feb.03 15:00:43 Up (1)
2009.Feb.03 15:00:14 Up (1)

Anything I've understood/done wrong? Of course we are on v1.6.2...

Thanks

[Calimero]

.last() ignores the argument it's given. It will only return/evaluate the last value.

You should try the "aggregate" functions like min/max/avg/count.

You could for example use something like that:
host:net.tcp.port[,1433].count(#3,1)=0

which reads "if the number of '1' I got over the last three checks is ... 0" (ie: last three check all returned 0).

You could also use .max(#3)=0 meaning "the maximum value over the last three checks is 0 (ie: all checks returned 0)".


PS: Be careful with 'simple checks', some of them return 0 or 2 (timeout) in case of failure so min/max is probably not really a good idea.

[radamand]

I can't get this to save-

{myserver:web.test.rspcode[myserver,Login].count(#2,200)}=0

(reading: "if the number of '200' i get over the last 2 checks is .. 0")

This is a trigger from a web scenario, I want to trip the trigger if the last 2 tests did not result in a "200".

When I save this I get "ERROR: Cannot update trigger".

[Andreas Bollhalder]

How about:

{myserver:web.test.rspcode[myserver,Login].count(#2,200,eq)}=0

As far I remember, you need at minimum 1.6 to work with this.

Andreas

[nms_user]

@Calimero:
Thanks for the answer.

Yes, i know about the "old" behaviour of .last() that it will return only the last polled value.

But i was really happy by reading the documentation Rev. 017 (for v1.6.2) where page 126 tells me:

last: Last (most recent) value. Parameter:
#num – Nth value
For example,
last(0) is always equal to last(#1)
last(#3) – third most recent value

Parameter #num is supported
starting from ZABBIX 1.6.2.

So where's the problem - wrong documentation / wrong trigger-definition / wrong understanding of mine / ?

Re: PS: The trigger isn't based on a simple check, its item is "Zabbix Agent" with net.tcp.port (which indeed is a simple port check, yes...)

[Calimero]

nms_user, I'm still running 1.6.1 (and working with an even older manual ) that's why I didn't now of the improved last() function.

Anyway, as I understand if, last() will still evaluate a single value but instead of giving you the very last you can now fetch value N, N-1, N-2... N-# ... but it will only evaluate a single value.

I think .min() or .count() is still the way to go or of course you could now write:

{host.key.last(#1)=0}&{host.key.last(#2)=0}&{host. key.last(#3)=0}

to check that the last 3 checks failed.




radamand >
The syntax .count(#42,whatever) is new to zabbix 1.6: count the number of 'whatever' occurrences over the last 42 checks.

If you're still running 1.4, only .count(600,whatever) is supported: count the number of 'whatever' occurrences over the last 600 seconds.