Check for missing

[alixen]

Hi,

Alert is "red" until time passes 15:20:00 even though "acknowledge" has been applied

Acknowledge don't change trigger state, it just mark it as .. acknowledged.
In order to reset the alert, trigger condition have to be false. In your case, either missing event appears in eventlog or time reaches 15:20:00.

This is a recurring problem in Zabbix, it is not easy to deal with systems that generate something when a problem appears but don't do anything when it disappears.
The only solution seems to be to use some time limit in trigger expression; but there is a chance to miss it since it will disappear from Zabbix dashboard.

Regards,
Alixen

[Flexyz]

Thanks - I can live with the trigger state.

But I still have problems getting the trigger right, so it will trigger the alert after my time frame - and not in the middle

[alixen]

But I still have problems getting the trigger right, so it will trigger the alert after my time frame - and not in the middle

OK, I think that you misunderstand how nodata() works.
nodata(300) means : Zabbix has not received any data during last 300 seconds. It becomes true 5 minutes after it stops getting new data.
Additional conditions based on time() just mask the fact that nodata(300) is true before 15:15:00 and after 15:20:00. It is unmasked at 15:15:01 so you get an alert at 15:15:30 since Zabbix evaluates nodata() conditions every 30 seconds.

If you are getting just one event per day, you should use something like nodata(86400) so that your nodata() condition will become true 24h after your last data.

Regards,
Alixen

[zalex_ua]

You trigger:

{cph41mrtg:eventlog[Application,,,"Check for Missing"].nodata(86460)}=1

where 86460 is 24 hours + one minute (just in case) in seconds.

Flexyz, you see? I gave the exact right decision!

when is the nodate started from?

If I do this :

({cph41mrtg:eventlog[Application,,,"Check for Missing"].time(0)}>111500 & {cph41mrtg:eventlog[Application,,,"Check for Missing"].time(0)}<112000)&{cph41mrtg:eventlog[Application,,,"Check for Missing"].nodata(300)}=1

The trigger fires at "11:15:00" - and not waiting 300 secs.

Damn, tell me why you started using the 300? I told you on a human being said - 86460

If you are getting just one event per day, you should use something like nodata(86400) so that your nodata() condition will become true 24h after your last data.

Flexyz, you see? Is another person telling you that! May eventually have you try what you say others experienced?
I still recommend you use 86460 or even 86520 (1 day plus 1 or 2 minutes). In such a case should not be a random false triggering in case when the time on the Windows PC and Zabbix server is different for 1-2 minutes, or even if not different.

And last, instead of permanent experiments start with reading the documentation and examples.

[Flexyz]

zalex_ua I am not trying to ignore your suggestions. I am just trying u understand it fully. So no need to write with !!

I really appreciate all the feedback but I was trying to get it working with some basic tests with 5 minutes ranges.

I will of course try 86460

[Flexyz]

I think I understand more now, and is it not true that my goal is difficult to achieve - because in my case the event might never occour and I need to have the alert when the event has not occurred in the given time frame (each day, or in another time frame)