How to see the data of the trigger ?

[mroussel]

Hello,

Is there a way to know which data triggered the zabbix trigger ?

Currently some of my triggers are triggered but I don't know why, I need to know to update the trigger to avoid wrong alerts

[myRCzabbix]

Have you tried going to Monitoring > Latest Data?

[mroussel]

Hello,

I tried, but I got many problem expression to generate the trigger.
I never know which one triggered the trigger so each time I go in the latest data, but it take many time and I never found the data that triggered the trigger.

[myRCzabbix]

Have you tried disabling most of them and leaving only 1 enabled at a time?

Another way would be to filter the problems by triggers.

[mroussel]

I tried but I wan't to understand why the trigger is triggered.

I need to see which data triggered the trigger

[myRCzabbix]

Once you find the trigger that caused it, check the expression in it.

I don't know what you have since you haven't posted details but if my trigger was composed of the following expressions:


{Template - Printer - Canon Generic:Toner_Cartridge-Black.strlen()}>0 and {Template - Printer - Canon Generic:Toner_Level-Black.last()}<16

then I would look at what was the value of Toner_Catridge-Black and Toner_Level-Black in Monitoring > Latest Data

[mroussel]

I did same, but in the latest data I don't see any matching data :
{TENOR-TELECOM2:log[/home/ftmaster/58/traces/journal.ftm,,ISO8859-1,,skip,,].str("Arret des process")}=1 or ({TENOR-TELECOM2:vfs.file.size[/home/ftmaster/58/traces/journal.ftm].last()} = {TENOR-TELECOM2:vfs.file.size[/home/ftmaster/58/traces/journal.ftm].last(#4)})

For exemple :
I don't find "Arret des process" in the latest at this date/time
I don't find the same size at this date/time

[myRCzabbix]

Your expression says, trigger the alert if:

1. You search for the string "Arret des process" and you find it (value of 1)

OR

2. You check the file size of /home/ftmaster/58/traces/journal.ftm and if it's size is equal to the size of the same file when you last checked it 4 times ago

Has the size of journal.ftm remained the same? I suspect the file size of journal.ftm has remained constant between your current check and the last 4 checks you did which is why the 2nd expression evaluates to TRUE and therefore the trigger is activated.

[mroussel]

Below the data when the trigger has been raise ( 10:43 am)

1 :
No "Arret des process" in the logs

2 : Not two times the same data below

2018-08-02 10:51:06	119845507
2018-08-02 10:50:06	119796402
2018-08-02 10:49:07	119779036
2018-08-02 10:48:06	119746053
2018-08-02 10:47:06	119740410
2018-08-02 10:46:06	119733038
2018-08-02 10:45:06	119718194
2018-08-02 10:44:06	119711180
2018-08-02 10:43:06	119696517
2018-08-02 10:42:06	119693192
2018-08-02 10:41:06	119691965
2018-08-02 10:40:06	119644463
2018-08-02 10:39:06	119627503
2018-08-02 10:38:06	119615925
2018-08-02 10:37:06	119609744
2018-08-02 10:36:07	119605703
2018-08-02 10:35:06	119575473
2018-08-02 10:34:06	119568646
2018-08-02 10:33:06	119564363

It's why I need another way to understand the issue.

[myRCzabbix]

Intriguing ... are the values you provided above the values returned by {TENOR-TELECOM2:vfs.file.size[/home/ftmaster/58/traces/journal.ftm].last()} ? I only ask because if it is, then you are right, it doesn't make any sense so perhaps another trigger is causing it? If the values above are not returned by {TENOR-TELECOM2:vfs.file.size[/home/ftmaster/58/traces/journal.ftm].last()} and you are just manually checking the size of the file, then perhaps {TENOR-TELECOM2:vfs.file.size[/home/ftmaster/58/traces/journal.ftm].last()} is not returning that value (for example, it could be that vfs.file.size cannot access the file due to permissions problem in which case it would be returning the same value over and over and it would trigger - did you check that the zabbix user has at least read permissions to the file?).