Ad Widget

Collapse

{#IFNAME} trigger filter

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

    {#IFNAME} trigger filter

    Hi, I have a trigger prototype to detect high traffic on network interfaces and it looks like this:

    Name:
    Too much incoming traffic on {#IFNAME} on {HOSTNAME}

    Expression:
    {Template OS Linux:net.if.in[{#IFNAME},bytes].min(5m)}>50M

    I would like to exclude interfaces named like eth1 because they are for backup purposes only.
    Can somebody help me to write and expression for that?

    #2
    based on this post Edit vfs.fs.size trigger NOT to go off for disk C: i created following workaround which might help in this case:

    using "Template OS Linux" ("Discovery rules" -> "Network interface discovery")

    "Item prototypes" -> Create item prototype
    Code:
    Name: Interface echo name {#IFNAME}
    Type: External check
    Key:  echo["{#FSNAME}"]
    Type of information: Text
    "Trigger prototypes" -> Create trigger prototype
    Code:
    Name: Over 10 MBit/s Incoming Traffic in last 5min on Interface {#IFNAME}
    Expression: {Template OS Linux:net.if.in[{#IFNAME}].last(5m)}>10M and {Template OS Linux:echo["{#IFNAME}"].regexp(^ppp)}=1
    "Trigger prototypes" -> Create trigger prototype
    Code:
    Name: Over 10 MBit/s Outgoing Traffic in last 5min on Interface {#IFNAME}
    Expression: {Template OS Linux:net.if.out[{#IFNAME}].last(5m)}>10M and {Template OS Linux:echo["{#IFNAME}"].regexp(^ppp)}=1
    have in mind that this creates triggers for *every* discovered interface, if you monitor devices with many interfaces, you might want to exclude unneeded interfaces from discovery in Administration->General->Regular expressions->Network interfaces for discovery

    tested on zabbix 3.2.7.
    Last edited by vchrizz; 30-09-2017, 15:47.

    Comment


      #3
      if you dont like the approach having many items and triggers, see thread Create trigger for interfaces where i posted another approach.

      Comment


        #4
        According to the documentation (Trigger expression), all trigger follow the syntax below:

        Code:
        Code:
          
        {<server>:<key>.<function>(<parameter>)}<operator><constant>
        {#IFNAME} = ppp0 is not allowed.

        Just create an item "ppp0" and a trigger using it, instead of using low-level discovery for this interface.

        Facetime for Android Download (Latest Update)
        Last edited by Ryan854; 11-01-2019, 09:37.

        Comment

        Working...
        X