Resolved Time earlier than Problem

[Mun]

Hi all,

I have an issue here where alert sending resolved time earlier than problem happened (as attach image).
May i know why? Since it only applicable on zabbix agent unreachable but others alert were working fine (second image).
Thanks.

[zux]

do you have a recovery expression configured for this trigger?

[ingus.vilnis]

This is more like a performance issue of Zabbix server. Please check the internal performance graphs of the server itself. Do you notice any spikes or overload there?

In short why you see the recovery time earlier than problem time.

This is typical for active checks and nodata triggers.
Agent collects data and sends to server.
Server evaluates the timestamps and calculates the nodata condition accordingly.
Then some overload on Zabbix server happens, network issue, DB unavailable etc etc. Zabbix server goes crazy.
The agents in the meantime can buffer the collected values with the timestamps when the agent collected them.
During the performance issue Zabbix server is still capable of calculating the nodata triggers and so does it put them into problem state because no data has been received.
Eventually Zabbix server recovers and starts accepting new data.
And then the buffered values from active agents (or trapper items but not in this case) comes in, with the timestamps older than the problem, thus you get the negative problem time.

https://support.zabbix.com/browse/ZBX-13309 for few more details but not sure how this was fixed because I got this very same behavior on 4.0.0 just few days ago.