Trigger should fire every new Value

[hupp]

Hi,

I have an zabbix trapper Item (from type character) which gets alters from an log analytics system. Every new value should fire the trigger.

At the moment my trigger looks like this: {logsrv01:log.alert.diff(0)}=1&{logsrv01:log.alert .nodata(30)}=0

The Problem on this trigger is, it fires only one times in 30 Seconds. But I can get multpile new items in a view seconds and every new item should fire this trigger so that I get multiple actions.

Anybody an idee to build the trigger expression?

[beli]

Place the nodata function in a separate trigger.
When an expression contains a time based function, like nodata, the trigger is evaluated every 30 sec. For all other functions it's evaluated on each new value.

[hupp]

If i didn´t have the nodata element, the trigger becommes one times true and will stay for ever in this condition.

[beli]

Yes, I see. Well, we were trying to accomplish the same, but didn't find an optimal solution with Zabbix.
Zabbix is great for monitoring performance data, when you have many values updated periodically, triggers can do many crazy things with them.
But from our experience, Zabbix does not handle "event driven" monitoring well - when you're getting some kind of events, or alert messages from other system, Zabbix lacks support for analyzing and displaying them, just as you found out.
I'd be glad if someone could prove me wrong.

[roby]

BUMP, I would also like a solution to this problem.

[peterodding]

I was looking for a way to push data from my agents to the server and have the server run a custom script (on the server) whenever new (changed) data is received. I don't need this to work at high frequency (in practice the data won't change for days).

I created a trapper item of type text to push data using zabbix_sender and use a trigger + action + media type to run my custom script on the Zabbix server (is there a less roundabout way that also does push instead of pull?). The trigger fires on the .change(0) of the trapper item.

Once I started experimenting I found that the trigger would activate on new data, but never deactivate. That's when I found this thread. For my low frequency use case I found a workaround; I send the new value twice using a single zabbix_sender call (--input-file). This activates and then deactivates the trigger, which is enough to run my action / media type.

[HullZabbix]

I'm beginning to realise zabbix isn't very good in this regard.

It picks up events from a windows event log fine. But getting it to trigger on particular events is very poor.

The whole .nodata and other time functions don't work correctly.

We just want the trigger to fire on new values of a certain severity (for example an error).

Just a bump really. Someone must have found a solution/work around?

[HullZabbix]

Here a possible solution to the problem.

{TemplateServers:eventlog[Application].logseverity(0)}=4 & {TemplateServers:eventlog[Application].change(0)}#0

It seems the .change does what I'm looking for. Now I just need to solve the incorrect content of the event when there's a few alerts in quick succession.