how to reduce false positives in Triger, due to outdated item values​​

[flako]

Hello, I'm using Zabbix 1.8.7 with Mysql in SLED 11 SP1.

I have a problem of trigger false positives, because sometimes I have items that are not updated in the expected range (the subject of performance or power cycle the server)

That is, I have a trigger that indicates whether the time for a host is outdated, it has the condition "{template_1: zabbix_localtime.sh [" sec "]. Last (0)} - {template_1: getHasar_relojSys.sh [" ftp sec "]. last (0)}> 7202", which are item "external check"

where:
zabbix_localtime.sh: Returns the time in seconds of zabbix server every 10 minutes.
getHasar_relojSys.sh: Returns the time in seconds of each 10 minutes Host

The trigger works fine, except that sometimes the item getHasar_relojSys.sh not updated every 10 minutes (one 2-hour delay firing the trigger causes a false positive)

I can not find an ideal way (correct) to check that the trigger condition is valid only if the timestamp / "Last check" of the two item are close (which do not differ by more than 30min)

As I can put the condition?

Through reading it, it was a struggle ..

[eskytthe]

Maybe hysteresis can help you.
http://www.zabbix.com/documentation/...ers#hysteresis
/Erik

[flako]

Hello Eskytthe
I can not understand how to use hysteresis (I think I explain bad) to solve the problem.

I explain with an example:
(Values is between "(" ")" are the Timestamp/ "Last check" the item )


Evaluation: localtime.sh = 08:00 (0800); relojSys = 08:01 (0802) -> TRIGGER.VALUE = 0 = OK (That's right, difference is less than 7202 s)
Evaluation: localtime.sh = 08:10 (0810); relojSys = 08:12 (0813) -> TRIGGER.VALUE = 0 = OK (That's right, difference is less than 7202 s)
Evaluation: localtime.sh = 08:20 (0820); relojSys = 08:22 (0820) -> TRIGGER.VALUE = 0 = OK (That's right, difference is less than 7202 s)
Evaluation: localtime.sh = 08:30 (0830); relojSys = 08:22 (0820) -> TRIGGER.VALUE = 0 = OK (That's right, difference is less than 7202 s)
Evaluation: localtime.sh = 08:40 (0840); relojSys = 08:22 (0820) -> TRIGGER.VALUE = 0 = OK (That's right, difference is less than 7202 s)
....
Repeat for 2 hrs ....
....
Evaluation: localtime.sh = 1010 (1010); relojSys = 08:22 (0820) -> TRIGGER.VALUE = 0 = OK (That's right, difference of less than 7202 s)
Evaluation: localtime.sh = 1020 (1020); relojSys = 08:22 (0820) -> TRIGGER.VALUE = 0 = OK (That's right, difference of less than 7202 s)
Evaluation: localtime.sh = 1020 (1030); relojSys = 08:22 (0820) -> TRIGGER.VALUE = 1 = PROBLEM (false positive is because the item to relojSys not updated for 2 hours.).


This false positive happened to me 2 times, one to shut down and restart the server (very bad coincidence I guess) and the other because the item relojSys actualizarce step 2 hours without (I guess that delay in the Queue)

I really can not think how to fix it .. these false positives and make me look bad JA

[eskytthe]

Sorry flako, have been away for some weeks ...

Two notes as I see the world:

1)
If I understand your trigger right - I think you can add a "nodata" function in the end - to test for data received. Something like this:
"{template_1: zabbix_localtime.sh [" sec "]. Last (0)} -
{template_1: getHasar_relojSys.sh [" ftp sec "]. last (0)}> 7202 &
{template_1: getHasar_relojSys.sh [" ftp sec "]. nodata (10m)} = 0"

2)
Think you can use the zabbix build-in trigger function "fuzzytime" instead of your scripts?
http://www.zabbix.com/documentation/...onfig/triggers
Do perform a lot better then externel scripts etc. and may be more stable.
Br
Erik

[flako]

Hello eskytthe
Use nodata not occurred to me: (, I will try.
and I also use fuzzytime() produces false positives, I have read that is a bug in zabbix. (I have to update version)

Thank you.