Trigger recovering

[[email protected]]

I read so much about alarm recovering and at some point it was not clear how this should work.
I could guess the recovery (for eventLog) would be the same expression followed by a nodata function.

Now, I am trying to configure a trigger in Zabbix in order to monitore a simple eventLog from a Windows server. The trigger works and an alarm raises but after 30s without this event it should get back to normal. But the problem is it never gets back to normal.

Here is the expression
{SERVER1:eventlog[Application,,,,15007,,skip].logeventid(15007)}=1
and

Recovery Expression
{SERVER1:eventlog[Application,,,,15007,,skip].nodata(30)}=1 I am using Zabbix v3.4.2 and I assume the red 'PROBLEM' word should be replaced by something saying there is no problem. In this case this problem is old and there is no new problem for some time so it should be cleared. Any idea ? Thanks in advance.

[kernbug]

Recovery Expression
{SERVER1:eventlog[Application,,,,15007,,skip].nodata(30)}=1 I am using Zabbix v3.4.2 and I assume the red '[FONT=arial]PROBLEM' word should be replaced by something saying there is no problem. In this case this problem is old and there is no new problem for some time so it should be cleared. Any idea ? Thanks in advance.

Hi

You can manually close such problems, detailed information: https://www.zabbix.com/documentation.../manual_close3

[Semiadmin]

Hi.
The event ID of the last log entry in your item is 15007 always because this item receives only such log records by the filter. So your trigger will fire forever. Try this trigger, without recovery expression:
{SERVER1:eventlog[Application,,,,15007,,skip].nodata(30)}=0

[[email protected]]

Thank you Semiadmin, this worked like a charm!