Trigger: servers is unreachable more than 5 min.

[Sysdebian]

Hello.

I have the item: "host status", which has a trigger:
Name: Server {HOSTNAME} is unreachable
Expression: {name_server:status.min(300)}=2
no dependencies.
Event generation: Normal
Severity: High
Next fields in white.

I have defined an action for high or disaster triggers, it send a mail (and it work fine).
With that trigger expression ({name_server:status.min(300)}=2), i understand it will send a mail only if the status server was "2" all the time in the last 5 minutes.
But, some time i get a mail "unreachable problem" and "unreachable ok" whith only 2 minutes of difference:
name_server Server name_server is unreachable: PROBLEM 2010.02.28 03:15:31
name_server Server name_server is unreachable: OK 2010.02.28 03:17:38

Maybe the problem was detected at 2010.02.28 03:10:31, wait 5 min for send mail, and then was recovery and the other mail for recovery. But in logs, i can see the next graphs (in monitoring, latest data, host status, graph):


I cant see in that graph when the trigger was execute, maybe im understanding wrong the expression.

Can anybody help me?

Installed:
Server:
Zabbix Server (daemon) v1.8.1 (revision 9702) (27 January 2010)
ZABBIX Agent (daemon) v1.8.1 (revision 9702) (27 January 2010) (installed from source)
Debian Lenny 5.0.3

Client:
ZABBIX Agent (daemon) v1.8.1 (revision 9702) (27 January 2010)
Debian Lenny 5.0.4

[ufocek]

Maybe you can use function nodata and agent ping, like this triggers?

{HOSTNAME:agent.ping.max(300)}<1 | {HOSTNAME:agent.ping.nodata(300)}=1

[Sysdebian]

Hi ufocek and thank for your reply.

But id like to understand if im doing something wrong with that triggers definition or is zabbix who is doing something bad ?

[MrKen]

This might help to explain things.

The "Host status" is just a special item, which DOES NOT represent host status, it provide us with status of a passive agent (ZABBIX and SNMP). This is really important to understand!

Because of this, use of the status for a host availability trigger is not a good idea. Consider using of a combination on function nodata() for a reliable item with a TCP or ICMP ping, if possible. This is much more efficient and bullet proof method with "built-in" flap detection adjusted by nodata's period.

From:http://www.zabbix.com/forum/showthread.php?p=39886