Trigger logic

[lukeiam]

Hello,

I am using Zabbix 2.0.2 on CentOS 5U8. I have backup done to the database as well as some other things that make load avg high. I have maintenance set so the trigger does not bug me during the backup. However, the events are still triggered. I back up every Saturday at 6am for about an hour.

My trigger is as follows:

{Template OS Linux:system.cpu.load[percpu,avg1].last(0)}>3 &
{Template OS Linux:system.cpu.load[percpu,avg1].dayofweek(0)}#6 &
{Template OS Linux:system.cpu.load[percpu,avg1].time(0)}<060000 |
{Template OS Linux:system.cpu.load[percpu,avg1].time(0)}>070000

Does any one can point out what's wrong with it?

My logic is:

if it's over load 3+ points AND it's on Saturday AND it's after 6am OR before 7am

Regards,

Luke

[lukeiam]

For now I use:

{Template OS Linux:system.cpu.load[percpu,avg1].last(0)}>3 &
{Template OS Linux:system.cpu.load[percpu,avg1].dayofweek(0)}#6 &
{Template OS Linux:system.cpu.load[percpu,avg1].time(0)}<070000

this blocks trigger between 0am to 7am every Saturday. However I would like it enable between 0 and 6am. For some reason the OR is now working properly.


Regards,

Luke

[lukeiam]

Resurecting this thread

Sorry but I am coming to this thread again.

Now I have several other triggers I need to set up the same way.

I am messing up the logic here I think, so I need someone to enlighten me.

I need to disable a trigger only for Saturday, between 6AM and 7AM.

I will use my previous post example:

{Template OS Linux:system.cpu.load[percpu,avg1].last(0)}>3 &
{Template OS Linux:system.cpu.load[percpu,avg1].dayofweek(0)}#6

That's what I use now. This disables trigger for the whole Saturday.
Does anyone know how to do this for a specific time?

Regards,

Luke

[lukeiam]

Resurecting this thread

UPDATE:

I can only do one or the other:

Disable trigger on Saturdays:
{Template OS Linux:system.cpu.load[percpu,avg1].last(0)}>3 & {Template OS Linux:system.cpu.load[percpu,avg1].dayofweek(0)}#6

Disable trigger every day between 6AM and 7AM:
{Template OS Linux:system.cpu.load[percpu,avg1].last(0)}>3 & {Template OS Linux:system.cpu.load[percpu,avg1].time(0)}>060000 & {Template OS Linux:system.cpu.load[percpu,avg1].time(0)}<070000

For some reason, I cannot figure out how to configure both.
I need Saturday, 6AM to 7AM only.

I tried a different approach as well - to use a maintenance window.
However, I still want to collect the data during maintenance window and what's happening for me is that triggers are still activating, just I don't get notifications. I don't want the triggers to activate at all.

Is this possible to accomplish either using the trigger or maintenance option?

Regards,

Luke

[lukeiam]

Resurecting this thread

UPDATE:

I use currently Zabbix 2.0.4. I looked at the release note for 2.0.5 and found ZBX-5896.

OR condition cannot be added correctly in trigger constructor
https://support.zabbix.com/browse/ZBX-5896

As I don't have need for OR, i don't think this patch will do anything for me, however, there's examples in the description:

It seems that OR condition cannot be added correctly in trigger constructor.
For example, "A & (B | C) | D" is expected in attached example1, "A & (B | D) & C" is expected in attached example2.

So, I was thinking:

A & (B & C & D)

A - load over 3
B - Saturday
C - it's after 6AM
D - it's before 7AM

How would I write this for a trigger?

Also, it is by design that maintenance with data still activates triggers?
Notices are not sent, which is nice, but I still do have events created which need an explanation for production purposes.

Regards,

Luke

[lukeiam]

No one?


I'm trying to add brackets to the expression but it does not work as per the example:

A & (B & C & D)

Ideas?

[heaje]

I would try it like this:

({Template OS Linux:system.cpu.load[percpu,avg1].last(0)}>3 & {Template OS Linux:system.cpu.load[percpu,avg1].dayofweek(0)}#6) | (({Template OS Linux:system.cpu.load[percpu,avg1].time(0)}<060000 | {Template OS Linux:system.cpu.load[percpu,avg1].time(0)}>070000) & {Template OS Linux:system.cpu.load[percpu,avg1].last(0)}>3 & {Template OS Linux:system.cpu.load[percpu,avg1].dayofweek(0)}=6)

In theory that should satisfy the requirements of:

Load>3 AND Saturday AND time<6am AND time>7am

Essentially, this means that this alert will only go off when: (load>3 AND not saturday) OR ((time<6am OR time>7am) AND load>3 AND saturday)

[heaje]

Also, it is by design that maintenance with data still activates triggers?
Notices are not sent, which is nice, but I still do have events created which need an explanation for production purposes.

Yes, it is by design that maintenance with data collection will still set off triggers. It can be very helpful in many cases. If simply seeing the trigger is the issue, you can filter out triggers that are in maintenance by customizing your dashboard.

If you don't want triggers to show up, you'll have to disable data collection during maintenance. Note with this that any triggers that DID go off BEFORE the maintenance window and are still active when data collection stops will stay in effect until data collection begins again.

[lukeiam]

I would try it like this:

({Template OS Linux:system.cpu.load[percpu,avg1].last(0)}>3 & {Template OS Linux:system.cpu.load[percpu,avg1].dayofweek(0)}#6) | (({Template OS Linux:system.cpu.load[percpu,avg1].time(0)}<060000 | {Template OS Linux:system.cpu.load[percpu,avg1].time(0)}>070000) & {Template OS Linux:system.cpu.load[percpu,avg1].last(0)}>3 & {Template OS Linux:system.cpu.load[percpu,avg1].dayofweek(0)}=6)

In theory that should satisfy the requirements of:

Load>3 AND Saturday AND time<6am AND time>7am

Essentially, this means that this alert will only go off when: (load>3 AND not saturday) OR ((time<6am OR time>7am) AND load>3 AND saturday)

I tested this and it was not working as expected. I went back to the bug report I shown above and decided to update from 2.0.4 to 2.0.5.



IT WORKS! I am reviewing your explanation and I failed to realize before that I will need to make 2 statements. I tried to make everything into one.

Thank you so much for your time!

Regards,

Luke

[lukeiam]

Yes, it is by design that maintenance with data collection will still set off triggers. It can be very helpful in many cases. If simply seeing the trigger is the issue, you can filter out triggers that are in maintenance by customizing your dashboard.

If you don't want triggers to show up, you'll have to disable data collection during maintenance. Note with this that any triggers that DID go off BEFORE the maintenance window and are still active when data collection stops will stay in effect until data collection begins again.

Great! Also, can you confirm that if I don't collect data during maintenance, not only trigger will not activate but also I will have gaps in the charts?

Regards,

Luke

[heaje]

IT WORKS!

I'm glad it worked . To be honest, I had to re-write it a few times before I felt like it was right. I was hoping I hadn't messed it up badly.

can you confirm that if I don't collect data during maintenance, not only trigger will not activate but also I will have gaps in the charts?

While I haven't done it myself, it makes sense that no triggers would go off and gaps would appear in graphs because no data is collected

[lukeiam]

I'm glad it worked . To be honest, I had to re-write it a few times before I felt like it was right. I was hoping I hadn't messed it up badly.

While I haven't done it myself, it makes sense that no triggers would go off and gaps would appear in graphs because no data is collected

Nope. I tested it a few times and I will test again, but all pass! 2.0.4 had a bug that OR was not executed properly but 2.0.5 works flawlessly.

I will use this on a few other triggers as well. The reason I wanted this, is that I wanted to collect data to see how's the performance during backups. Backups however, are activating few triggers.

Again, Thank you.

Regards,

Luke