Ad Widget

Collapse

Trigger Cisco ASA not working properly

Collapse
X
 
  • Time
  • Show
Clear All
new posts
  • Linwood
    Senior Member
    • Dec 2013
    • 398

    #16
    To the last, you must give it a different key. If it's a prototype include the index in the key.

    As to the underlying question I've tried, but sometimes the goal of a user is difficult to align with the strengths of a product. Or perhaps I may just be not seeing the right path, hopefully someone else can.

    Comment

    • lpossamai
      Senior Member
      • Jun 2018
      • 119

      #17
      Originally posted by Linwood
      To the last, you must give it a different key. If it's a prototype include the index in the key.

      As to the underlying question I've tried, but sometimes the goal of a user is difficult to align with the strengths of a product. Or perhaps I may just be not seeing the right path, hopefully someone else can.
      umm... I can't put a different key otherwise the script won't work (External check)....

      and I am pretty sure somebody else would use this feature and not only me....

      Comment

      • Linwood
        Senior Member
        • Dec 2013
        • 398

        #18
        I have no idea what you are trying to do. My suggestion was a poll (I gather external) for your data, and a second item that is a calculated item. A calculated item isn't an external script (or if you want it to be external it would be a different external script). WE're obviously talking past each other, hopefully someone else will show up who understands better.

        Comment

        • lpossamai
          Senior Member
          • Jun 2018
          • 119

          #19
          Originally posted by Linwood
          I have no idea what you are trying to do. My suggestion was a poll (I gather external) for your data, and a second item that is a calculated item. A calculated item isn't an external script (or if you want it to be external it would be a different external script). WE're obviously talking past each other, hopefully someone else will show up who understands better.
          I appreciate the help Linwood and I am sorry if you haven't understood my problem yet.... But I think I made it pretty clear of what I am trying to achieve here....

          When I create a new calculated item, it asks me for the Key that I am going to use. And because I already have another item with that same key, it throws me that error.

          My Device name: Cisco_ASA_2

          Item number 1:
          Name: VPN XXX Sent
          Type: External check
          Key:
          Code:
          query_lan2_lan_cisco_final.pl["public","192.168.9.254","ASA","get","TX","201.201.201.201"]
          Item number 2:
          Name: VPN XXX Sent - Calculated
          Type: Calculated
          Key:
          Code:
          query_lan2_lan_cisco_final.pl["public","192.168.9.254","ASA","get","TX","201.201.201.201"]
          Formula:
          Code:
           last("Cisco_ASA_2:query_lan2_lan_cisco_final.pl["public","192.168.9.254","ASA","get","TX","201.201.201.201"]"}-last("query_lan2_lan_cisco_final.pl["public","192.168.9.254","ASA","get","TX","201.201.201.201"])
          Error:
          Code:
          Item with key "Cisco_ASA_2:query_lan2_lan_cisco_final.pl["public","192.168.9.254","ASA","get","TX","201.201.201.201"]" already exists on "Cisco_ASA_2".
          One solution would be to copy that script (
          Code:
          query_lan2_lan_cisco_final.pl
          ) with a different name only for this calculated key in particularly... but I mean.. really? That much of work to only monitor an item during a period of time?

          Comment

          • kernbug
            Senior Member
            • Feb 2013
            • 330

            #20
            Originally posted by lpossamai
            When I create a new calculated item, it asks me for the Key that I am going to use. And because I already have another item with that same key, it throws me that error.
            Hi,

            Choose another key for the calculated item. Here is a special item key for you: "query_lan2_lan_cisco_final.calculated.TX.254.to.2 01"

            Comment

            • lpossamai
              Senior Member
              • Jun 2018
              • 119

              #21
              Originally posted by kernbug
              Hi,

              Choose another key for the calculated item. Here is a special item key for you: "query_lan2_lan_cisco_final.calculated.TX.254.to.2 01"
              Hi,

              but for that I will need to rename the query_lan2_lan_cisco_final.pl script, correct? I will need two scripts, then:

              Code:
              query_lan2_lan_cisco_final.pl
              query_lan2_lan_cisco_final_calculated.pl

              Comment

              • kernbug
                Senior Member
                • Feb 2013
                • 330

                #22
                Originally posted by lpossamai

                Hi,

                but for that I will need to rename the query_lan2_lan_cisco_final.pl script, correct? I will need two scripts, then:

                Code:
                query_lan2_lan_cisco_final.pl
                query_lan2_lan_cisco_final_calculated.pl
                Nope ) Just use another key.

                Comment

                • lpossamai
                  Senior Member
                  • Jun 2018
                  • 119

                  #23
                  Originally posted by kernbug

                  Nope ) Just use another key.
                  yup..

                  So...

                  Type: Calculated
                  Key: vpn_calculated_test
                  Formula: last("query_lan2_lan_cisco_final.pl["public","192.168.9.254","ASA","get","TX","201.201 .201.201"]"}+last("query_lan2_lan_cisco_final.pl["public","192.168.9.254","ASA","get","TX","201.201 .201.201"])
                  Custom intervals - Scheduling: wd1-5h04-05 (Weekdays from 4am to 5am).

                  I get the following error:
                  Code:
                  In get_value_calculated() key:'vpn_calculated_test' expression:'last("query_lan2_lan_cisco_final.pl["public","192.168.9.254","ASA","get","TX","201.201.201.201"]")+last("query_lan2_lan_cisco_final.pl["public","192.168.9.254","ASA","get","TX","201.201.201.201"]")'
                    4360:20180711:170029.256 Item [:vpn_calculated_test] error: Incorrect function 'last' expression. Check expression part starting from "query_lan2_lan_cisco_final.pl["

                  Comment

                  • kernbug
                    Senior Member
                    • Feb 2013
                    • 330

                    #24
                    Originally posted by lpossamai

                    yup..

                    So...


                    I get the following error:
                    Code:
                    In get_value_calculated() key:'vpn_calculated_test' expression:'last("query_lan2_lan_cisco_final.pl["public","192.168.9.254","ASA","get","TX","201.201.201.201"]")+last("query_lan2_lan_cisco_final.pl["public","192.168.9.254","ASA","get","TX","201.201.201.201"]")'
                    4360:20180711:170029.256 Item [:vpn_calculated_test] error: Incorrect function 'last' expression. Check expression part starting from "query_lan2_lan_cisco_final.pl["
                    Don't forget about backslash, like:
                    Code:
                     query_lan2_lan_cisco_final.pl[\"public\",\"192.168.9.254\",\"ASA\",\"get\",\"TX\",\"201.201.201.201\"]

                    Comment

                    • lpossamai
                      Senior Member
                      • Jun 2018
                      • 119

                      #25
                      Originally posted by kernbug

                      Don't forget about backslash, like:
                      Code:
                       query_lan2_lan_cisco_final.pl[\"public\",\"192.168.9.254\",\"ASA\",\"get\",\"TX\",\"201.201.201.201\"]
                      Backslash? Why do I need to use that? :O

                      That worked kernbug ... could you please explain why do I need to use backslashes? cheers!
                      Last edited by lpossamai; 11-07-2018, 23:22.

                      Comment

                      • kernbug
                        Senior Member
                        • Feb 2013
                        • 330

                        #26
                        Originally posted by lpossamai

                        Backslash? Why do I need to use that? :O

                        That worked kernbug ... could you please explain why do I need to use backslashes? cheers!
                        It's a magic!

                        ​A non-quoted backslash ‘\’ is the escape character. It preserves the literal value of the next character that follows and Zabbix item keys are not shell-interpreted.

                        Comment

                        • lpossamai
                          Senior Member
                          • Jun 2018
                          • 119

                          #27
                          Originally posted by Linwood

                          If I understand your requirement (and I might not), it's not really a hit, though it may be useful.

                          Everything in zabbix that I can think of is about polling. So scheduling intervals are the same -- you want to poll during 4-5 am (let's say) you could schedule that, but each poll will do an evaluation of the trigger. What you want (right?) is to poll during that time, and only evaluate the trigger once at the end of that period.

                          Maybe you could use two items, one polls continually, one is a calculated item that polls in a custom interval only at 5:01am, and it calculates the sum over the prior hour. Then the trigger is based solely on this new calculated item (and so is only evaluated at 5:01am).

                          Maybe something like that?
                          Linwood The trigger would need to be something like:

                          Code:
                          {Cisco_ASA_2:item_calculated.last(0)}<50000
                          Where 50000 = 50Kbps ?

                          Item item_calculated:
                          Code:
                          last("query_lan2_lan_cisco_final.pl[\"public\",\"192.168.9.254\",\"ASA\",\"get\",\"TX\",\"201.201.201.201\"]")+last("query_lan2_lan_cisco_final.pl[\"public\",\"192.168.9.254\",\"ASA\",\"get\",\"RX\",\"201.201.201.201\"]")
                          Custom intervals:
                          Scheduling wd1-5h04-05

                          Because that alert gets triggered outside of the Scheduling interval.
                          Cheers!


                          EDIT: The item works fine... and it only gets the data at the scheduled time. I just need to figure out how to create the trigger.

                          EDIT 2: Trigger was easy to create...

                          Problem expression: If the traffic on that VPN during that time (Between 4am-5am weekdays in this case) has been less than 500 Kbps
                          Code:
                          {Cisco_ASA_2:item_calculated.last(0)}<50000
                          Recovery expression: If the trafficon that VPN during that time (Between 4am-5am weekdays in this case) has been more than 500 Kbps
                          Code:
                          {Cisco_ASA_2:item_calculated.last(0)}>50000
                          Last edited by lpossamai; 15-07-2018, 07:21.

                          Comment

                          • lpossamai
                            Senior Member
                            • Jun 2018
                            • 119

                            #28
                            Originally posted by lpossamai

                            ...


                            EDIT: The item works fine... and it only gets the data at the scheduled time. I just need to figure out how to create the trigger.

                            EDIT 2: Trigger was easy to create...

                            Problem expression: If the traffic on that VPN during that time (Between 4am-5am weekdays in this case) has been less than 500 Kbps
                            Code:
                            {Cisco_ASA_2:item_calculated.last(0)}<50000
                            Recovery expression: If the trafficon that VPN during that time (Between 4am-5am weekdays in this case) has been more than 500 Kbps
                            Code:
                            {Cisco_ASA_2:item_calculated.last(0)}>50000
                            The trigger is still not working fine. It gets triggered when it wasn't supposed to.

                            Problem expression that I am using:
                            Code:
                            {Cisco_ASA_1:item_calculated.last(0)}<250000
                            Recovery expression that I am ussing:
                            Code:
                            {Cisco_ASA_1:item_calculated.last(0)}>250000
                            Expected:
                            If the item_calculated item is less than 250000 (250 Kbps), then triggers an alert.


                            EDIT: It is not the trigger that isn't working.. it's the calculated item. Please check https://www.zabbix.com/forum/zabbix-...ing-zabbix-3-4
                            Last edited by lpossamai; 19-07-2018, 23:48.

                            Comment

                            Working...