Host flapping up/down

[mcmyst]

Hello,

I have a trigger on some important host which is like that :

{HOSTA:icmpping[,2,25,68,200].last(#1)}=0 & {HOSTA:icmpping[,2,25,68,200].last(#2)}=0

I have set a SMS alert linked to this trigger.
When a host is flapping UP/DOWN (mostly during spanning-tree topology change) this trigger fire up 4 or 5 times. So the problem is that we receive lot of SMS for these hosts.

We need to have an alert when the 2 last attempt of ping failed, but once the trigger has fired up, I would like to not fire up again during a certain period.

Do you have a solution ?

Thank you

[JBo]

Hi,

You may use hysteresis to have different conditions on trigger up and down.
Something like:
({TRIGGER.VALUE}=0&{HOSTA:icmpping[,2,25,68,200].max(#2)}=0)|
({TRIGGER.VALUE}=1&{HOSTA:icmpping[,2,25,68,200].min(#10)}=1)

(I have replaced your two calls to last() by a single max() that does the same thing)

It will fire as soon as you have 2 pings that fail but will not reset until 10 pings are OK.

Hope this helps
JBo

[mcmyst]

Exactly what I need !
I will check it this afternoon.

Thank you

[mcmyst]

I tried this trigger :

({TRIGGER.VALUE}=0&{HOSTA:icmpping[,2,25,68,200].max(#2)}=0)
| 
({TRIGGER.VALUE}=1&{HOSTA:icmpping[,2,25,68,200].min(#10)}=1)

but something is wrong:
The host "HOSTA" is being checked every 30 seconds by a icmpping simple check. When I block (with iptables) icmp ping from zabbix server to HOSTA, the trigger fire up when 2 pings fails. ==> OK

I keep blocking the ping, but the trigger change from state PROBLEM to OK and OK to PROBLEM every 30 seconds. ==> NOT OK

Can I had something to this trigger to resolve this issue ?

Thank you

[JBo]

Hi,

Sorry, I made a mistake on second part of the trigger.
I have tested the formula below, it works:

({TRIGGER.VALUE}=0&{test:icmpping[,2,25,68,200].max(#2)}=0)
|
({TRIGGER.VALUE}=1&{test:icmpping[,2,25,68,200].count(#10,0,"eq")}>0)

Regards,
JBo

[mcmyst]

Thank you JBo, I just tried and its working !

[Zaniwoop]

host flapping?

[xibbaz]

Hi,

Sorry, I made a mistake on second part of the trigger.
I have tested the formula below, it works:

({TRIGGER.VALUE}=0&{test:icmpping[,2,25,68,200].max(#2)}=0)
|
({TRIGGER.VALUE}=1&{test:icmpping[,2,25,68,200].count(#10,0,"eq")}>0)

Regards,
JBo

I had this problem of 2 flapping internet modems caused by the VRRP router sitting between them.

This has solved it and I can at last create reliable dependencies on them.

Thank you, thank you, thank you!

[rubendob]

What does mean?

Hi

thanks by the formula, nice.

Can somebody explain to us what does mean the final sentence of the trigger?

count(#10,0,"eq")}>0)

¿¿¿¿¿?????

Thanks

[Zaniwoop]

count(#10,0,"eq"): How many of the last 10 values were equal to 0.

....}>0): If this is number is greater than 0.

[rubendob]

Thanks Zaniwoop

[rubendob]

Doubt

Hi

based on this thread and your experience how can we build new trigger about latency?

Example

host icmppingsec > 50 FIRE!
host icmppingsec < 50 OK!

({TRIGGER.VALUE}=0&{test:icmppingsec[,,,,].max(#5)}>50)
|
({TRIGGER.VALUE}=1&{test:icmppingsec[,,,,].count(#10,0,"eq")}<50)

I have doutbs about the last part of trigger:

test:icmppingsec[,,,,].count(#10,0,"eq")}<50

what do you think? Can be useful??

Thanks

[jraies]

Explain [,2,25,68,200]

please explain the following statement
[,2,25,68,200]
in
({TRIGGER.VALUE}=0&{test:icmpping[,2,25,68,200].max(#2)}=0)
|
({TRIGGER.VALUE}=1&{test:icmpping[,2,25,68,200].count(#10,0,"eq")}>0)