how to create complicated triger ?

[Sir_Yaro]

Hi.
First of all sorry for the stupid thread title - but I have no idea how to describe my problem in a few words. :|
I would be very grateful for your help in creating one trigger. It drives me crazy.

I have an item with recorded velues (errors count):
0,0,0,0,3,3,3,3,4,4,4,4,2,2,2,2,0,0,0,0


I'm trying to create trigger which meet the following conditions:

1. It will fire up when the item value will change (something bad/good has happened) -> 1st, 2nd and 3rd group of bolded values,
2. I need to keep that triger fired up until item value is 0 (no more errors) or (if its easier) for a few days -> 4th group of bolded values,
3. It will generate new PROBLEM EVENT every time item value will change (new problem or problem gone) -> 2nd and 3rd group of bolded values.

Conditions 1 and 2 are easy to meet together but whatever I try I can't meet third one.
I tried calculated items, "Event generation" set to "Normal + Multiple PROBLEM events" etc in countless combinations but it just doesn't work... :/ Usualy my triger fired up every time new value is recorded or doesn't work at all..

[Sir_Yaro]

Does anyone know is it possible to create such trigger?

[Yello]

Hi,

Conditions 1 and 2 are easy to meet

Please show how you're doing this. You say it's easy but it seems to be causing you some problems.

whatever I try I can't meet third one.

How about this pseudo-code trigger:

item.min(4)#0

Which means that if any of the last 4 item values is non-zero then the trigger will fire.

You're description of your problem is a bit woolly so my understanding of what you're asking may be incorrect. I've not directly addressed your point 3 cos I don't see how that would be a problem at all. I would expect a trigger similar to the above to do what you need.


Regards,
David

[Sir_Yaro]

Hi,

Please show how you're doing this. You say it's easy but it seems to be causing you some problems.



How about this pseudo-code trigger:

item.min(4)#0

Which means that if any of the last 4 item values is non-zero then the trigger will fire.

You're description of your problem is a bit woolly so my understanding of what you're asking may be incorrect. I've not directly addressed your point 3 cos I don't see how that would be a problem at all. I would expect a trigger similar to the above to do what you need.


Regards,
David

Sorry. I didn't use english for a some time now and I'm afraid is a bit rusty

In my company zabbix operators doesn't see two types of events: acknowledged (of any type) and informational.
Any event which can't be fixed at the moment will be acknowledged with proper description (it's big simplification of the whole procedure but you should get the point).

Now imagine that device report an error. Error is being checked, investigate and reported to manufacturer. And acknowledged at the end. That mean it will disapper from monitoring.
There is always a small likelihood that the very same device will report a new error. Errors count will increase but trigger is already fired up and acknowledged so no one will know about it.

Basicaly I need to fired up this damn trigger again.

[gunter]

Have you tried the change function? eg. {YOUR HOST:KEY.change(0)}=1

Maybe you're looking for the Hysteresis example (the last one on this page): http://www.zabbix.com/documentation/...onfig/triggers

[Sir_Yaro]

Have you tried the change function? eg. {YOUR HOST:KEY.change(0)}=1

Maybe you're looking for the Hysteresis example (the last one on this page): http://www.zabbix.com/documentation/...onfig/triggers

change will fire up trigger if there is a difference between last and previous value. Which is great but one cycle later there won't be difference and trigger will gone. ex:

10:30 -> item = 1
10:31 -> item = 1 (change 0)
10:32 -> item = 2 (change 1) -> fire up triger
10:33 -> item = 2 (change 0) -> triger will back to normal state

[bellamy]

There is always a small likelihood that the very same device will report a new error. Errors count will increase but trigger is already fired up and acknowledged so no one will know about it.

[Yello]

Here's a suggestion for something that might work (pseudo-code):

(TRIGGER.VALUE=0) & (item.last#0 & item.change(0)=1) | (TRIGGER.VALUE=1) & (item.count(#3,item.last(0),"eq") | item.last(0)=0 )

...which means that if the trigger is ok and the last value isn't 0 and the value changes then the trigger should fire. Then if the trigger is in a problem state and the trigger value hasn't changed for a period of time (in this case 3 checks), or it is 0, then the trigger should suppress.

If you insist that the trigger can only suppress at a value of 0 then I think you'll need to look at creating separate triggers to capture each unqiue triggering condition. That's because you'll be specifying multiple criteria for triggering but only 1 criteria for suppression. That will leave you trigger in a problem state for too long, as you've already found out.

Be aware that for the moment I don't have a zabbix environment to test any of this against so I can't be prescriptive with what I'm suggesting.


Regards,
David

[Sir_Yaro]

Thank you David. I'll try that and I let you know how it works.

[gunter]

change will fire up trigger if there is a difference between last and previous value. Which is great but one cycle later there won't be difference and trigger will gone. ex:

10:30 -> item = 1
10:31 -> item = 1 (change 0)
10:32 -> item = 2 (change 1) -> fire up triger
10:33 -> item = 2 (change 0) -> triger will back to normal state

Yup. That's the Hysteresis idea.

Eg.:

({TRIGGER.VALUE}=0&{server:temp.last(0)}>20)|({TRI GGER.VALUE}=1&{server:temp.last(0)}>15)

Check it out: http://www.zabbix.com/documentation/...onfig/triggers