Trigger function for new item data?

[Makihiko]

Hi,

I have a another system (OSSEC) that sends alerts (text) into Zabbix via zabbix_sender. I want to create an action to send an email asap after a new value is received for that item. What kind of trigger function is best used in this case? nodata? If I use nodata(30)}#1 then its possible that two alerts may arrive in 30 seconds and then I miss the 2nd last alert. I simply need to be alerted when new data arrives..

Any help or nudge or some direction would be great appreciated.

[Makihiko]

Perhaps another way to phrase this question, I would like to create a trigger if the timestamp of the last received value is different to the one before it. I just need to detect new item data.

[Makihiko]

For anyone interested, I got some help on irc, It seems that {C_Linux_Template.OSSEC.regexp(.*)}=1 does the job as long as you specify "multiple problem events".

[pvradu]

Hi Makihiko,

I've followed the instructions from here:

http://www.zendzign.com/2010/04/zabbix-ossec-open-source-compliance-and-security-monitoring/

Unfortunately, I can't seem to get alerts in Zabbix, I tried to run zabbix_sender manually, but:

"response":"success",
"info":"Processed 0 Failed 1 Total 1 Seconds spent 0.000031"

OSSEC server resides on the same with Zabbix, and the command I tried was:

/usr/bin/zabbix_sender -vv --zabbix-server 127.0.0.1 --port 10051 --host an-internal-hostname --key OSSEC --value 'this-should-be-alert-description'

Thanks,
Radu

[Heilig]

Set up ServerActive in zabbix_agentd.conf and/or check hostname, item name and item type on conformity between the data sent and the way that host or item is setup on the Zabbix server.