Announcement

Collapse
No announcement yet.

Host flapping up/down

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

    Host flapping up/down

    Hello,

    I have a trigger on some important host which is like that :
    Code:
    {HOSTA:icmpping[,2,25,68,200].last(#1)}=0 & {HOSTA:icmpping[,2,25,68,200].last(#2)}=0
    I have set a SMS alert linked to this trigger.
    When a host is flapping UP/DOWN (mostly during spanning-tree topology change) this trigger fire up 4 or 5 times. So the problem is that we receive lot of SMS for these hosts.

    We need to have an alert when the 2 last attempt of ping failed, but once the trigger has fired up, I would like to not fire up again during a certain period.

    Do you have a solution ?

    Thank you

    #2
    Hi,

    You may use hysteresis to have different conditions on trigger up and down.
    Something like:
    ({TRIGGER.VALUE}=0&{HOSTA:icmpping[,2,25,68,200].max(#2)}=0)|
    ({TRIGGER.VALUE}=1&{HOSTA:icmpping[,2,25,68,200].min(#10)}=1)

    (I have replaced your two calls to last() by a single max() that does the same thing)

    It will fire as soon as you have 2 pings that fail but will not reset until 10 pings are OK.

    Hope this helps
    JBo

    Comment


      #3
      Exactly what I need !
      I will check it this afternoon.

      Thank you

      Comment


        #4
        I tried this trigger :
        Code:
        ({TRIGGER.VALUE}=0&{HOSTA:icmpping[,2,25,68,200].max(#2)}=0)
        | 
        ({TRIGGER.VALUE}=1&{HOSTA:icmpping[,2,25,68,200].min(#10)}=1)
        but something is wrong:
        The host "HOSTA" is being checked every 30 seconds by a icmpping simple check. When I block (with iptables) icmp ping from zabbix server to HOSTA, the trigger fire up when 2 pings fails. ==> OK

        I keep blocking the ping, but the trigger change from state PROBLEM to OK and OK to PROBLEM every 30 seconds. ==> NOT OK

        Can I had something to this trigger to resolve this issue ?

        Thank you

        Comment


          #5
          Hi,

          Sorry, I made a mistake on second part of the trigger.
          I have tested the formula below, it works:
          Code:
          ({TRIGGER.VALUE}=0&{test:icmpping[,2,25,68,200].max(#2)}=0)
          |
          ({TRIGGER.VALUE}=1&{test:icmpping[,2,25,68,200].count(#10,0,"eq")}>0)
          Regards,
          JBo

          Comment


            #6
            Thank you JBo, I just tried and its working !

            Comment


              #7
              host flapping?
              Attached Files

              Comment


                #8
                Originally posted by JBo View Post
                Hi,

                Sorry, I made a mistake on second part of the trigger.
                I have tested the formula below, it works:
                Code:
                ({TRIGGER.VALUE}=0&{test:icmpping[,2,25,68,200].max(#2)}=0)
                |
                ({TRIGGER.VALUE}=1&{test:icmpping[,2,25,68,200].count(#10,0,"eq")}>0)
                Regards,
                JBo
                I had this problem of 2 flapping internet modems caused by the VRRP router sitting between them.

                This has solved it and I can at last create reliable dependencies on them.

                Thank you, thank you, thank you!

                Comment


                  #9
                  What does mean?

                  Hi

                  thanks by the formula, nice.

                  Can somebody explain to us what does mean the final sentence of the trigger?

                  Code:
                  count(#10,0,"eq")}>0)
                  ¿¿¿¿¿?????

                  Thanks

                  Comment


                    #10
                    count(#10,0,"eq"): How many of the last 10 values were equal to 0.

                    ....}>0): If this is number is greater than 0.

                    Comment


                      #11
                      Thanks Zaniwoop

                      Comment


                        #12
                        Doubt

                        Hi

                        based on this thread and your experience how can we build new trigger about latency?

                        Example

                        host icmppingsec > 50 FIRE!
                        host icmppingsec < 50 OK!

                        Code:
                        ({TRIGGER.VALUE}=0&{test:icmppingsec[,,,,].max(#5)}>50)
                        |
                        ({TRIGGER.VALUE}=1&{test:icmppingsec[,,,,].count(#10,0,"eq")}<50)
                        I have doutbs about the last part of trigger:

                        test:icmppingsec[,,,,].count(#10,0,"eq")}<50

                        what do you think? Can be useful??

                        Thanks

                        Comment


                          #13
                          Explain [,2,25,68,200]

                          please explain the following statement
                          [,2,25,68,200]
                          in
                          ({TRIGGER.VALUE}=0&{test:icmpping[,2,25,68,200].max(#2)}=0)
                          |
                          ({TRIGGER.VALUE}=1&{test:icmpping[,2,25,68,200].count(#10,0,"eq")}>0)

                          Comment

                          Working...
                          X