Trigger syntax question

[xcalibur]

Hi,

I have setup a trigger to alert me once the CPU usage is over 90%.

{SERVERerf_counter[\Processor(_Total)\% Processor Time].max(60)}>90

The thing is, I get an email each time there's a spike even for one milisecond.
So what I'd like to do is make it fire up the alert only if the spike lasts for over a minute. But I simply dont understand the the concept of min\max here. Would someone mind elaborating?

Thanks

[lseror]

min and max

if you use max(60), you will trigger when there is any spike over 90% within 60s. Maybe you can use avg(60), so if the average is over 90% during the last minute, it will send you a trigger. Or you can use count(60,90,"gt")>2 so it will trigger when you got 3 spikes over 90% in the last 60s.

[xcalibur]

if you use max(60), you will trigger when there is any spike over 90% within 60s. Maybe you can use avg(60), so if the average is over 90% during the last minute, it will send you a trigger. Or you can use count(60,90,"gt")>2 so it will trigger when you got 3 spikes over 90% in the last 60s.

I'll give it a shot!
Thanks.
BTW, with your logic, wouldnt a "min" function suppose to sort this out?

[frater]

Yes, I would use 'min' for this situation...

Last year I suggested to add a 'median()' function that in some situations will give a better result (less sensitive to exceptional situations). min() could be too insensitive...

http://www.zabbix.com/forum/showthread.php?t=20490

Maybe you can bring it to the dev's attention?