Don't want to trigger Pages/sec during the night

[dalkje]

Hi all,

At night, both of my Exchange servers are de fragmenting and they are being backed up, so the Pages/sec are higher than normal at night. This triggers a lot of emails to my mailbox during the night, so I want to change the trigger to only trigger during the day...
To do this, I have created the expression below, but when I save this expression, it doesn't work. When I press the Test button and I fill 100000 as time and 2000 as value for the pages/sec in, it says TRUE to all the values so it should work... After that I log on to my Exchange Server, copy a large file to another location, which makes the value go over 2000 for a long period of time, but that doesn't make the system send me an email.. As soon as I edit the expression again to only leave the first expression intact (the pages/sec), the system does send me an email...
Can someone help me with this? It all seems fine to me... I'm using version 2.0.2 by the way..

Here the expression :

{Microsoft Exchange Servererf_counter[\Memory\Pages/sec].avg(#5)}>1000 & {Microsoft Exchange Servererf_counter[\Memory\Pages/sec].time(0)}>080000 & {Microsoft Exchange Servererf_counter[\Memory\Pages/sec].time(0)}<230000

[jerrylenk]

To do this, I have created the expression below, but when I save this expression, it doesn't work.

Does it refuse to save the expression? First thing I'd try is putting 80000 without leading zero.


edit:
Else, if it is only the notifications that bother you, not the trigger events in the record, you could define another media for your e-mail adress, which is only active from 8:00 to 23:00, and use that one especially for this notification.

[dalkje]

Hi Jerry,

Thank you for your reply and sorry for not coming back earlier...
Yes, it does save the expression, but during the night I still get those emails about the Exchange server having high Pages / sec...

The mail I get during the night is (I created a custom text):

Trigger: Exchange: Average of Last 5 Memory Pages per sec >1000 during the day Trigger status: PROBLEM Trigger severity: Average Trigger URL:

Item values:

1. 10096 (SRV03-SUZO-03erf_counter[\Memory\Pages/sec]): 7005.5661 2. 10096 (SRV03-SUZO-03erf_counter[\Memory\Pages/sec]): 7005.5661 3. 10096 (SRV03-SUZO-03erf_counter[\Memory\Pages/sec]): 7005.5661

And the expression is :

{Microsoft Exchange Servererf_counter[\Memory\Pages/sec].avg(#5)}>1000 & {Microsoft Exchange Servererf_counter[\Memory\Pages/sec].time(0)}>080000 & {Microsoft Exchange Servererf_counter[\Memory\Pages/sec].time(0)}<230000

The solution you provide might be useful, but I also want the trigger to work well... In the meantime I upgraded to 2.0.3, but that doesn't change a thing...
Does the expression also look OK to you?

[jerrylenk]

The expression looks quite like the example in the manual.
http://www.zabbix.com/documentation/...es_of_triggers

I wonder if the server disagrees with you about the daytime? Is it on UTC? I wouldn't expect this to be a problem, but maybe it is.

You could add to your Notification message something like:

It is now {{HOSTNAME}:perf_counter[\Memory\Pages/sec].time(0)}

just to make sure.

[dalkje]

That's strange...
When I put your message into the notification I get :

Trigger: Exchange: Average of Last 5 Memory Pages per sec >1000 during the day Trigger status: PROBLEM Trigger severity: Average Trigger URL:

It is now 015718

Item values:

1. 10102 (SRV03-SUZO-07erf_counter[\Memory\Pages/sec]): 2004.0063 2. *UNKNOWN* (*UNKNOWN*:*UNKNOWN*): *UNKNOWN* 3. *UNKNOWN* (*UNKNOWN*:*UNKNOWN*): *UNKNOWN*


Strange thing is that this time it didn't trigger although it was during the day and the values were >1000. I removed the >080000 and <230000 to make sure it triggered and after that I received the message above...
This server is located in the UK and the Zabbix Server is located in the NL. The Zabbix Server is an Ubuntu 12.04 server and the Exchange server is installed on a Windows 2003 Server... What server reports the time in the wrong value? At the time of the trigger it was 10:57 in NL so, 9:57 GMT but the server reported 014759??? It switched the first 2 digits?
It triggered this one by copying a large file on that server and as soon as I stopped copying, I received a mail again (SOLVED) with the following info:

Trigger: Exchange: Average of Last 5 Memory Pages per sec >1000 during the day Trigger status: OK Trigger severity: Average Trigger URL:

It is now 020239


Item values:

1. 10102 (SRV03-SUZO-07erf_counter[\Memory\Pages/sec]): 63.7268 2. *UNKNOWN* (*UNKNOWN*:*UNKNOWN*): *UNKNOWN* 3. *UNKNOWN* (*UNKNOWN*:*UNKNOWN*): *UNKNOWN*

US time?

[dalkje]

Problem solved...
US Time was configured on the server...
Thanks for your help!

[jerrylenk]

You're welcome! I also learned from this one.

[dalkje]

But I may have a new one related to this and I think you can help me with this.
On 2 of our servers there are 4 services that are being stopped during the night because of a backup. The first time those services are stopped is at 23:00, the second time they are stopped is at 6:30 in the morning. These services are very important for us, so I want to have a trigger in case these services are stopped during the day, so I created a trigger for them. The problem I have though is that it is hard to create a trigger with AND and OR expressions.

At the moment I have this as a trigger :

{SERVER1:service_state[Bmon001].time(0)}>080000 & {SERVER1:service_state[Bmon001].time(0)}<220000 & {SERVER1:service_state[SUZMON].last(0)}#0 | {SERVER1:service_state[UPLMON].last(0)}#0 | {SERVER1:service_state[Bmon001].last(0)}#0 | {SERVER1:service_state[EmailMon001].last(0)}#0

This will almost work, but it still triggers after 22:00 if all services have a status of >0...

Do you see an error in this one?

[jerrylenk]

In boolean logic AND is like multiplication, OR is like addition.

So if you put in some braces like this:

time-condition & time-condition & (last-condition | last-condition | last-condition | last-condition)

it should work.

[dalkje]

You are a STAR!
Thank you, this worked perfect!