Zabbix Trigger Sensitivity on zabbix_sender data

[slash5k1]

Hi guys,

Im trying to take advantage of the time period expression with a trigger thats attached to data that's being inputted via a zabbix_sender however it doesnt seem to work.

the expression im using is:
{test-server:test[TEST].min(60)}=1
which i believe is saying if the min value for the last 60 seconds = 1 then trigger as a problem. However when zabbix_sender sends the 1, the trigger is fired instantly and my escalation emails are sent...

does the time period expression only work for zabbix_agentd data ??
or am i missing something thats rather obvious ?

im using zabbix 1.6.2

cheers lads

Chris

[Calimero]

Err... if you send "1" and that's the only value over the last 60 seconds then min(60)==1 hence the trigger going ON.

Edit:I inverted max and min (shame on me!). If you use .min(60) and have 0/0/0/0/1 over the last minute, then min(60) will evaluate to 0.

What exactly do you want to do ?

[slash5k1]

Hi Calimero,

Thankyou for responding!

Perhaps i wasnt entirely clear

I am monitoring a log file using a custom perl script that watches for a specific pattern. If the script gets a match it will use zabbix_sender to send a 1 to our server, if it doesnt then it will send a 0.

This pattern test happens for each line as the log file moves. So a 1 could constantly be sent or a 0 depending on how fast the file moves or if the pattern keeps being hit etc.

So i dont keep being sent emails for every 1 that zabbix_sender sends i want to setup the trigger to only goto a problem state if the min value for the past 60 seconds is a 1.

From what i understand the trigger in my original post {test-server:test[TEST].min(60)}=1 should do just that, however im finding as soon as zabbix_sender sends a 1 to the server without even waiting 60 seconds I am sent an email.

I am using this exact same trigger for zabbix_agentd data which is working well, however this is the first time I have used zabbix_sender and thought maybe im missing something...

Any help would be much appreciated.

Cheers,

Chris

[Calimero]

Your trigger seems to be working fine, to me.

Trigger functions are working on "rolling data". I mean that it will work on the previous X (X seconds or N values) last samples of data.

So when you write .min(60)=1 it must be read as: "if over the last rolling 60 seconds the minimum polled value is 1, then trigger is true."

That's why the trigger fires right after you get a value of 1. And it will stay ON for 60 seconds unless there's another 1 that will "reset the counters" (*) and go for another 60secs.

EDIT: Wow. What the hell was this ?. As you said slash5k1, it should trigger only when you only got "ones" on the last minute. So if over the last minute you send 0/1/0/0/1/0 to zabbix, the trigger should not be ON.

zabbix_agentd items are polled at fixed interval that's why there is (or there seems to be) some "pacing".


If you describe precisely what behavior you want maybe we'll be able to help you ?

For log processing (I'm using zabbix' built-in log[] item but the idea is pretty much the same), I use the count() function to trigger things only if I have a certain amount of errors over a period of time so that a single error will be ignored. Is that what you want ?


(*) actually it can be even "worse" if you don't have enough samples flowing. you may need to add a fake now() or time() condition to force evaluation.

[slash5k1]

That's why the trigger fires right after you get a value of 1. And it will stay ON for 60 seconds unless there's another 1 that will "reset the counters" (*) and go for another 60secs.

Hmmm... So lets say zabbix_sender sends over the course of a minute 0,0,0,0,0 and then finally sends a 1 to signify a pattern match, are you saying with my original expression the trigger will fire instantly and ignore the past 60 seconds that there has been no error ? I was kind of hoping that it would look at the 1 and then start the 60 second timer unless a 0 is sent before the 60 seconds is up which would cancel the timer...

I use the count() function to trigger things only if I have a certain amount of errors over a period of time so that a single error will be ignored.

Thats exactly what i am after, i dont want to get emails if an error appears in the log and then the log keeps rolling with no more errors, however if i get a stream of errors for a period of 60 seconds or an error and the log file doesnt move for 60 seconds (ie the app has died) then i want to get an email

I figured i could just use the example given here http://www.zabbix.com/forum/blog.php?b=2 to achieve my goal. Can you show me an example of using the count expression to achieve the result im after

Cheers for responding,

Chris

[slash5k1]

Hi,

Using {test-server:test[TEST].count(60,1)}>10

looks to be working, however i need to cater for when an error happens and the log doesn't keep rolling ie zabbix_sender stops sending data.

I figured i could use something like...

{test-server:test[TEST].count(60,1)}>10 | ({test-server:test[TEST].count(60,1)}>0 & {test-server:test[TEST].nodata(60)}=1)

however this doesn't appear to be working any ideas ?

Cheers,

Chris

[slash5k1]

Looks like i found what i wanted with:

({test-server:test[TEST].count(30,1)}>10|({test-server:test[TEST].count(#1,0,"gt")}>0&{test-server:test[TEST].nodata(60)}=1))

Im hoping im doing the right thing...

Cheers for putting me on the path of using count(), i still would like to understand the max/min() expressions, perhaps someone else could shed some more light on achieving the above if possible using the max/min functions.

Thanx!

Chris

[Calimero]

Cheers for putting me on the path of using count(), i still would like to understand the max/min() expressions, perhaps someone else could shed some more light on achieving the above if possible using the max/min functions.

You were right. Looks like I was a bit sleepy yesterday. I somehow read max() instead of min() ...

I edited my posts above.

But I don't understand why your .min(60) returns 1 right after you send a value of 1.

I've tested it here and sending 0/1/0/1/0/0/0 over one minute won't trigger a .min(60)=1 trigger.

You can go to the Latest data screen, show the values as ... values instead of graph (use "Latest 500 values"). That way you'll get the values and the timestamp. You'll be able to "evaluate by hand".