trigger expression help

[td3201]

I have a custom userparameter configured on an agent (found it in the cookbook). It lists out all services that are set to automatic startup and are not set to started. This is fine but I want to add some exclusions into the mix. So, I want it to trigger if there are services that are not started and set to automatic EXCEPT for "distributed transaction coordinator" and "performance logs and alerts". This is what I have as my trigger. By the way, the item is working great, it shows these two services.

({Windows_t:uServicesNotRunning.str(None)}=0) & ({10.51.1.13:uServicesNotRunning.regexp(Distribute d Transaction Coordinator)}=1) & ({10.51.1.13:uServicesNotRunning.regexp(Performanc e Logs and Alerts)}=1)

The UI just gives me:
ERROR: Cannot add trigger

[td3201]

I was able to get it added but I need to rethink my logic:

({10.51.1.13:uServicesNotRunning.regexp(Distribute d\ Transaction\ Coordinator)}=1)&({10.51.1.13:uServicesNotRunning. regexp(Performance\ Logs\ and\ Alerts)}=1)

I want the trigger to fire if uServicesNotRunning contains anything but "performance logs and alerts" and "distrubuted transaction coordinator".

I think I will get it, when/if I do, I will post back here in case it helps others.

[trikke]

Hi td3201,

why don't u filter at the source??
wmic service where "Startmode='Auto' and state!='Running' and DisplayName!='Performance Logs and Alerts' and DisplayName!='Distributed Transaction Coordinator'" get DisplayName

so no filtering at trigger

simple trigger:
{Template_Windows:system.run[wmic service ... get DisplayName]. str( DisplayName ) }=1

Greets

Patrick

[td3201]

So you mean put the filtering logic in the agent's config file? If that's the case then that means anytime I have to change the logic, I need to go to every agent that affects and manually update their config file. If it's in a trigger, I can use the templating logic to apply the change across a great number of affected hosts if needed.

If you mean somewhere in the item, please elaborate.

Thanks!

[trikke]

Hi,
U are right, if u have the item as a agent-parameter, then u have to change all your agent conf files!! That's why i never or seldom use agent parameter and use system.run[] items, since then the "configuration" of the item is on the Server side!

So in your case your solution seems to be the right one!
Hold on u should use:
({10.51.1.13:uServicesNotRunning.regexp(Distribute d\ Transaction\ Coordinator)}#1)&({10.51.1.13:uServicesNotRunning. regexp(Performance\ Logs\ and\ Alerts)}#1)
--> if item does NOT contain ... --> trigger true !

Greets
Patrick

[td3201]

Patrick,

Thank you for your help. The copy and paste of your example didn't work but I am curious, if it should NOT contain those values, isn't that supposed to look like this:
regexp([^Distributed\ Transaction\ Coordinator])

??

That's how I thought you specified that in regular expressions (at least in perl).

I appreciate your clarification.

In the end, I don't like this solution. I posted a suggestion to have the agent be 'aware' of the services on it's host. This opens the opportunity to allow a user to select which services to monitor.

Thinking about this further, this is probably still a possibility:
1. Create an item to pull all services through a system.run or wmi or something.
2. Don't trigger off of this. This is purely informational.
3. Use this list to know which services are on the box.
4. Create additional items and triggers using this list.

That make sense?

[trikke]

Hi,

Actually you're rigth but also wrong!! ???

regexp([^Distributed\ Transaction\ Coordinator]) = 1 --> you search for a string not containing, checking if this is true ==> your expression will value to TRUE

regexp(Distributed\ Transaction\ Coordinator) # 1 --> you search for a string containing, chekcing if this is not true ==> your expression will value to TRUE
(reverse logic!!)

Zabbix just compares every incomming value ( change of item ) with the Trigger expression and generates an Event (False/Problem or True/OK).
Hope have clarified this a bit.

Be shure to check the value your item returns to see if the trigger is apropriate,

Greets
Patrick