Zabbix false alerts

[monismonther]

Hi MrKen,

I did the changes and will wait for a few days if all is well, I will post back here to confirm that case is solved, otherwise I will continue to troubleshoot and see where we get with this problem.

Thanks for your help

[EnigmA-X]

Looks to me that your problem is solved

[monismonther]

Hi Enigma-X,

It seems so hopefully but I want to wait till next Monday and close this at that time. Thanks for your help

[monismonther]

SOLVED

Thanks Enigma-X and all the others who helped solve this issue.

[untergeek]

I too initially tried to use Actions/escalations to change when and how notifications happened. Wherever possible, design your triggers properly to handle notification timing. I learned this the hard way. It seems your cases has largely mirrored my experience.

Remember, kids. Actions are for just that, ACTION. Let your triggers do the actual calculations of when an action is worthy to happen.

[nleaman]

@monismonther,

Don't use '.last(300)}>5'. According to the docs, 300 seconds will be ignored if you use last.

... just wondering if this is still true? I am trying to find where this is referenced in the docs. Is it where it says sec paramenter is ignored? Seems like last(300) would be what you want if you want, for example, to trigger of a response is not 1 for 300s or more.

[EnigmA-X]

Yes, this is still ignored.

More information: follow this link (scroll down a bit to '4.12.2 Trigger functions').

[nleaman]

Good info to know. It is intuative, for me, to want to specify "for the last 300 seconds" ... now I'm not sure how to best specify a tcp simple check that is not 1 for more than 300 seconds. Because I want a Problem event if the result is 0 or 2, yet an OK event if the result is 1. Something like I think:

{tName:tcp,2200.min(300)}#1|{tName:tcp,2200.max(30 0)}#1

Is this a good way to do it? Does it help to add in an "|{tName:tcp,22.nodata(300)}=0" as well?

[EnigmA-X]

The best solution for you depends also on the item interval.

The approach I mostly use, is to make use of the avg()-function.

If you expect your tcp-check to result in '1', you could use .avg(300)#1 to trigger once the average value is not 1 over the last 300 seconds.

The nodata() function can be used to measure if data is collected at all. I advise to use a separate trigger for this, to reduce complexity.

[nleaman]

If you expect your tcp-check to result in '1', you could use .avg(300)#1 to trigger once the average value is not 1 over the last 300 seconds.

I started to do it this way. I'm wondering if whether or not the item is stored as an Numeric (unsigned) or Numeric (float) affects the the trigger calulcation result? I would assume that the result would always be a float, but I wouldn't want to assume too much.