trigger {Standard PING:icmppingsec.max(120)}>300 does not work

[ahuser]

Hi @ all,

I have to build two triggers for icmpping alerts

1. {Standard PING:icmppingsec.max(120)}>300
2. {Standard PING:icmppingsec.avg(#10)}=0

but max or average or any other doesn't work correctly I become for all single peak an alert .
Whats wrong i can't find the bug in the string

item ist configured:
icmppingsec
nummeric (float)
ms
multiply = 1000
interval = 1sec

and the triggers such as top described

thx for the anwers and sorry for my bad english
Andreas

[zabbix_zen]

Hallo Andreas.

If I've correctly understood your problem,
for #1 you'll want

{Standard PING:icmppingsec.min(120)}>300

meaning, it'll only trigger when the min value from the last collected 120 seconds is bigger than 300 (thus filtering sporadic spikes)


For, #2

{Standard PING:icmppingsec.avg(#10)}=0

I didn't quite understand the issue.
It should only trigger when the average from the last 10 collected values is 0.
you could replace it by

{Standard PING:icmppingsec.max(#10)}=0

[bernard]

use min instead of max

Same as zabbix zen (but he writes faster than me ;-))

Hi,

Use min() inseated of max(). Doesn't make sense ?

Explanation:
you want to get an alert if ICMP ping sec value is over 300 during 2 minutes.
in your trigger expression icmpingsec.max(120)}>300 means: if during last 2 minutes, the maximum value is greater than 300. You trigger will fire at the first time value is greater than 300.

Think another way:
use min: if during last 2 minutes, the minimum value is greater than 300, the trigger goes on. This means your values are over 300 for 2 minutes.

Sometimes I need to write on the paper to be sure to create the correct trigger.

1. {Standard PING:icmppingsec.min(120)}>300

try
2. {Standard PING:icmppingsec.max(#10)}=0

Best Regards,
Bernard

[ahuser]

Thank you very much for the answer!

If one understands the logic is much easier
You did great work!

Greetings from Germany
Andreas