Notification when current traffic exceeds 50% of the previous month's

[ZabbixFun]

Hi all,

Although I use zabbix for a few years now, this is my first post on the forums.

First of all I would like to say a big thanks to the developers, as it is a great piece of software and helped me a lot in monitoring all kinds of services.

And I really hope I will be able to attend this year's conference.

------------

You guys have a lot more experience in configuring zabbix than me, so I would like to ask you if it is possible to create a notification when (in and/or out) traffic exceeds 50% of the previous month's average traffic.

I understand that to calculate the total bandwidth on eth0 I can use:

last("net.if.in[eth0,bytes]")+last("net.if.out[eth0,bytes]")

And to calculate the percentage of incoming traffic I can use:

100*last("net.if.in[eth0,bytes]")/(last("net.if.in[eth0,bytes]")+last("net.if.out[eth0,bytes]"))

But, is there a way to retrieve the last month's average traffic, compare it with the current month's traffic and then receive a notification?

This is mainly to see if there is a big increase of traffic that would indicate a possible issue.

May be there is a better and easier solution for this, so any help or links to other posts is appreciated.


Thanks in advance.

Kind regards

[jan.garaj]

Some functions support time shifting. Also last() supports it, so use it (30days = 43200seconds):

{last("net.if.in[eth0,bytes]")+last("net.if.out[eth0,bytes]") / last("net.if.in[eth0,bytes]",43200)+last("net.if.out[eth0,bytes]",43200)} > 1.5

{100*last("net.if.in[eth0,bytes]")/(last("net.if.in[eth0,bytes]")+last("net.if.out[eth0,bytes]"))/
100*last("net.if.in[eth0,bytes]",43200)/(last("net.if.in[eth0,bytes]",43200)+last("net.if.out[eth0,bytes]",43200))} > 1.5

Test and debug it, it's only untested concept ;-) IMHO, it'll be better if you use avg() function instead of last() (eg. hour average). Eventually you can have a problem with spikes. But you know your infrastructure and what do you need. So maybe last() is the best option for you.

https://www.zabbix.com/documentation/2.2/manual/appendix/triggers/functions

[ZabbixFun]

Thanks jan.garaj,

It seems that avg() with time_shift would be the best solution, however I don't know whether traffic spikes would cause many false alarms.

I will test it and post the results.

Thank you for your answer.

Regards,