Am I reading this icmp trigger correctly?

[phoeneous]

{Template Networking:icmpping.count(#10,0,"eq")}=0 + {Template Networking:icmppingloss.avg(60)}>75

Says if the last ten pings are equal to zero and the packet loss average in the last minute is greater than 75 then host is down.

I was getting too many false positives with icmpping.last(0)=0.

I can't seem to find a simple icmp trigger to use for down hosts.

Any help is appreciated.

[phoeneous]

Anyone? Bueller?

[mbsit]

Trigger is LOGIC expression, so you can't use '+', you should use "AND" .
Or use the trigger expression constructor utility.

The rest seems to be OK.

[phoeneous]

Doesn't work.

Incorrect trigger expression. Check expression part starting from " AND {Template Networking:icmppingloss.avg(60)}>75".

[pad19]

Doesn't work.

Incorrect trigger expression. Check expression part starting from " AND {Template Networking:icmppingloss.avg(60)}>75".

I think you should use & instead AND:

https://www.zabbix.com/documentation/2.0/manual/config/triggers/expression

Also it is better to use .last(#x) instead of count(#x,y,"eq"), I red that .last is quicker method.

Maby make it simple:
{Template Networking:icmppingloss.last(#6)}>75

We can say for example you are sending ping every 30sec, so #6 packets is 3min. So in 3min can be lost 75% of pings = 4/6 ~ 67%. If there will be 5/6 or 6/6 lost you get alert/action.

[mbsit]

Of course "AND" mean "&" and "OR" mean "|"
If you are not sure, use Expression Constructor.

BUT function last have absolutely different meaning.
Last(#6) mean, the 6-th value from now, backward.

https://www.zabbix.com/documentation/2.0/manual/appendix/triggers/functions

So, the trigger could be like this:
{Template Networking:icmpping.count(#10,0,"eq")}=0 & {Template Networking:icmppingloss.avg(60)}>75

Or

{Template Networking:icmpping.count(600,0,"eq")}=0 & {Template Networking:icmppingloss.avg(60)}>75

600 - means last then minutes.

Bests,
Grzegorz

--
Wdrożenia Zabbix - Warszawa

https://www.mbs-it.pl

[phoeneous]

I think you should use & instead AND:

https://www.zabbix.com/documentation/2.0/manual/config/triggers/expression

Also it is better to use .last(#x) instead of count(#x,y,"eq"), I red that .last is quicker method.

Maby make it simple:
{Template Networking:icmppingloss.last(#6)}>75

We can say for example you are sending ping every 30sec, so #6 packets is 3min. So in 3min can be lost 75% of pings = 4/6 ~ 67%. If there will be 5/6 or 6/6 lost you get alert/action.

So then last(6) would mean the last 6 most recent values?

[mbsit]

Yes: https://www.zabbix.com/documentation...gers/functions

Bests,
Grzegorz

--
Wdrożenia Zabbix - Warszawa

https://www.mbs-it.pl