I have a text item which returns either "OK somestatus" or "ERROR someotherstatus", and I'd like a trigger expression to alert if there's a "non-OK" value more than three times in a row (it flaps a bit which I don't want to get alerted about, that's handled by lower-severity triggers).
I'm trying to make an expression like this:
{My_template_name:my.itemname.iregexp("^OK",#3)}=0
That is, trigger expresson is true if it there is no match for an item beginning with "OK" in the last three.
Looking around at documentation and examples hasn't helped me and I've been trying loads of different variants. I just can't get it to match anything whatsoever. Just doing this seems to sort of work:
{My_template_name:my.itemname.iregexp("OK",#3)}=0
but since the letters "ok" can occur in the rest of the item value (and often does) this just doesn't cut it.
So many questions!
Btw, using zabbix 1.8.3. Some agents are 1.8.1/1.8.2, but that shouldn't matter once the value is on the server (which it is).
I'm trying to make an expression like this:
{My_template_name:my.itemname.iregexp("^OK",#3)}=0
That is, trigger expresson is true if it there is no match for an item beginning with "OK" in the last three.
Looking around at documentation and examples hasn't helped me and I've been trying loads of different variants. I just can't get it to match anything whatsoever. Just doing this seems to sort of work:
{My_template_name:my.itemname.iregexp("OK",#3)}=0
but since the letters "ok" can occur in the rest of the item value (and often does) this just doesn't cut it.
So many questions!
- Should I quote the expression at all? Single/double quotes? If unquoted, do I need to escape a lot of characters, like ')' and ','?
- Can regexp/iregexp handle "number of items" (#3) instead of just a time interval (like 180 seconds)?
- I can do the regexp in the web-based editor thingy, and it works just fine. Is that regexp of any use in the trigger, or is it just usable for testing out preg_match()?
Btw, using zabbix 1.8.3. Some agents are 1.8.1/1.8.2, but that shouldn't matter once the value is on the server (which it is).
10 years and some more..
Comment