Ad Widget

Collapse

Trigger for an external check at a specific time of the day

Collapse
X
Collapse
 
  • Page of 1
  • Time
  • Show
Clear All
new posts
Previous template Next
  • lpossamai
    Senior Member
    • Jun 2018
    • 119
    #1

    Trigger for an external check at a specific time of the day

    Hi all,

    I have got the following item setup, which monitors a Site-to-Site VPN on my Cisco ASA:
    Code:
    Name: 1 IPSec VPN RX
Type: External Check
Units: bps
Preprocessing: Change per second
Preprocessing: Multiplier 8
    I would like to create a trigger that checks if that VPN connection had traffic at a specific time of the day (i.e 2am).

    So, for example:

    Code:
    if 1 IPSec VPN RX traffic > 0.3 Mbps between 2AM and 3AM, then ok. Else, trigger!
    How can I do that? What would be the trigger expression, please?

    Would that be something like:
    Code:
    {[URL="http://monitor.motorweb.co.nz/zabbix/items.php?form=update&itemid=30543"]Cisco_ASA_1:query_lan2_lan_cisco_final.pl["public","192.168.1.1","ASA","get","RX","203.203.203.203"][/URL].[B]min([/B]0200,0300[B])[/B]}>0.3

    Thanks in advance!

    EDIT 1:

    Tried something like:
    Code:
    ({Cisco_ASA_1:query_lan2_lan_cisco_final.pl["public","192.168.1.1","ASA","get","RX","203.203.203.203"].min(300)}>300000) &
({Cisco_ASA_1:query_lan2_lan_cisco_final.pl["public","192.168.1.1","ASA","get","RX","203.203.203.203"].time(0)}>020000) &
({Cisco_ASA_1:query_lan2_lan_cisco_final.pl["public","192.168.1.1","ASA","get","RX","203.203.203.203"].time(0)}<030000)
    That doesn't work.. I get "Incorrect trigger expression.

    EDIT 2: I may have found the solution from the Documentation.

    Code:
    {Cisco_ASA_1:query_lan2_lan_cisco_final.pl["public","192.168.1.1","ASA","get","RX","203.203.203.203"].min(2m)}>200000
and {Cisco_ASA_1:query_lan2_lan_cisco_final.pl["public","192.168.1.1","ASA","get","RX","203.203.203.203"].time(0)}>020000
and {Cisco_ASA_1:query_lan2_lan_cisco_final.pl["public","192.168.1.1","ASA","get","RX","203.203.203.203"].time(0)}<030000
    I will monitor it overnight and check the trigger tomorrow.
    Last edited by lpossamai; 20-06-2018, 03:40.
    Tags: external check, trigger, triggers, zabbix
    • lpossamai
      Senior Member
      • Jun 2018
      • 119
      #2
      UPDATE:

      That trigger was not triggered last night.. so the expression is not working?

      Code:
       
 {Cisco_ASA_1:query_lan2_lan_cisco_final.pl["public","192.168.1.1","ASA","get","RX","203.203.203.203"].min(2m)}>200000 and {Cisco_ASA_1:query_lan2_lan_cisco_final.pl["public","192.168.1.1","ASA","get","RX","203.203.203.203"].time(0)}>020000 and {Cisco_ASA_1:query_lan2_lan_cisco_final.pl["public","192.168.1.1","ASA","get","RX","203.203.203.203"].time(0)}<030000

        Comment

        • kernbug
          Senior Member
          • Feb 2013
          • 330
          #3
          Originally posted by lpossamai
          UPDATE:

          That trigger was not triggered last night.. so the expression is not working?

          Code:
          {Cisco_ASA_1:query_lan2_lan_cisco_final.pl["public","192.168.1.1","ASA","get","RX","203.203.203.203"].min(2m)}>200000 and {Cisco_ASA_1:query_lan2_lan_cisco_final.pl["public","192.168.1.1","ASA","get","RX","203.203.203.203"].time(0)}>020000 and {Cisco_ASA_1:query_lan2_lan_cisco_final.pl["public","192.168.1.1","ASA","get","RX","203.203.203.203"].time(0)}<030000
          Hi

          Please, show latest data from Dashboard for this time(between 2 and 3 AM).

            Comment

            • lpossamai
              Senior Member
              • Jun 2018
              • 119
              #4
              Originally posted by kernbug

              Hi

              Please, show latest data from Dashboard for this time(between 2 and 3 AM).
              okay.... so turns out the Trigger is indeed working. However, I still need to tweak it a little bit.

              The expression is as follow:
              Code:
              {Cisco_ASA_1:query_lan2_lan_cisco_final.pl["public","192.168.1.1","ASA","get","RX","203.203.203.203"].last(0)}<200000 and {Cisco_ASA_1:query_lan2_lan_cisco_final.pl["public","192.168.1.1","ASA","get","RX","203.203.203.203"].time(0)}>020000 and {Cisco_ASA_1:query_lan2_lan_cisco_final.pl["public","192.168.1.1","ASA","get","RX","203.203.203.203"].time(0)}<030000
              What I need:
              If the traffic over that VPN, between 2am and 3am, is lower than 200 Kbps (200000 bps) send an alert.

              That expression is not doing what I need. yesterday there was traffic and I got an alert, which shouldn't have happened.

              Lattest data for that is:
              Click image for larger version Name: Screenshot from 2018-06-25 09-49-36.png Views: 235 Size: 118.5 KB ID: 361047

              What am I doing wrong? Cheers!
              Attached Files

                Comment

                • kernbug
                  Senior Member
                  • Feb 2013
                  • 330
                  #5
                  Originally posted by lpossamai

                  What I need:
                  If the traffic over that VPN, between 2am and 3am, is lower than 200 Kbps (200000 bps) send an alert.

                  That expression is not doing what I need. yesterday there was traffic and I got an alert, which shouldn't have happened.
                  Hi

                  So, you have this with .last() statement:
                  Code:
                   ...{Cisco_ASA_1:query_lan2_lan_cisco_final.pl["public","192.168.1.1","ASA","get","RX","203.203.203.203"][B].last(0)[/B]}<200000...
                  https://www.zabbix.com/forum/zabbix-...834#post170834

                  Try to use .min(600)

                    Comment

                    • lpossamai
                      Senior Member
                      • Jun 2018
                      • 119
                      #6
                      Originally posted by kernbug

                      Hi

                      So, you have this with .last() statement:
                      Code:
                      ...{Cisco_ASA_1:query_lan2_lan_cisco_final.pl["public","192.168.1.1","ASA","get","RX","203.203.203.203"][B].last(0)[/B]}<200000...
                      https://www.zabbix.com/forum/zabbix-...834#post170834

                      Try to use .min(600)
                      Did that... and I am still getting alerted.
                      Click image for larger version Name: Screen Shot 2018-06-26 at 10.36.56 AM.png Views: 241 Size: 97.7 KB ID: 361135


                      because there was traffic between 2am and 3am, I shouldn't have got an alert.

                        Comment

                        • kernbug
                          Senior Member
                          • Feb 2013
                          • 330
                          #7
                          Originally posted by lpossamai

                          Did that... and I am still getting alerted.
                          Click image for larger version Name: Screen Shot 2018-06-26 at 10.36.56 AM.png Views: 241 Size: 97.7 KB ID: 361135


                          because there was traffic between 2am and 3am, I shouldn't have got an alert.
                          Oh, my mistake with the expression:

                          Code:
                          .max(1h)=0 and .time>X and .time<Y

                            Comment

                            • lpossamai
                              Senior Member
                              • Jun 2018
                              • 119
                              #8
                              Originally posted by kernbug

                              Oh, my mistake with the expression:

                              Code:
                              .max(1h)=0 and .time>X and .time<Y
                              Okay, NW... so now it looks like this:
                              Code:
                              {Cisco_ASA_1:query_lan2_lan_cisco_final.pl["public","192.168.1.1","ASA","get","RX","203.203.203.203"].max(1h)}=0 and {Cisco_ASA_1:query_lan2_lan_cisco_final.pl["public","192.168.1.1","ASA","get","RX","203.203.203.203"].time(0)}>020000  and {Cisco_ASA_1:query_lan2_lan_cisco_final.pl["public","192.168.1.1","ASA","get","RX","203.203.203.203"].time(0)}<030000
                              Will test it tonight. Cheers!

                                Comment

                                • lpossamai
                                  Senior Member
                                  • Jun 2018
                                  • 119
                                  #9
                                  Okay.. so that worked kernbug . Thanks for the help. I get it now... Cheers!

                                    Comment

                                    Previous template Next
                                    Working...