autoclose problems after a period of time

[BartTechne]

I have a trigger that hits every time a success backup gets written in the event log (checks every 1 minute as a test)
{HOST-ACRONIS:eventlog[Application,,,Acronis Backup and Recovery,1,,skip].nodata(86400)}=0 and
{HOST-Acronis:eventlog[Application,,,Acronis Backup and Recovery,1,,skip].logseverity()}=1

I have made a Recovery expression :
{HOST-Acronis:eventlog[Application,,,Acronis Backup and Recovery,1,,skip].nodata(40000)}=1

It does not auto close the problems.
Is theire a way to do this ? I searched the forums but did not find a definite soltiuon

[nneka]

Hi,

i don't undestand what you wanna do :

{HOST-ACRONIS:eventlog[Application,,,Acronis Backup and Recovery,1,,skip].nodata(86400)}=0 => Why a 1 day nodata ??

{HOST-Acronis:eventlog[Application,,,Acronis Backup and Recovery,1,,skip].logseverity()}=1 => Why this check ?

you could try :

{HOST-Acronis:eventlog[Application,,,Acronis Backup and Recovery,1,,skip].nodata(10)}=0

with this method , you will have a alert when they are a new entry in your eventlog (matching acronis..) ...and after 10 minutes , you alert will be closed

no recovery expression needed

[BartTechne]

{HOST-Acronis:eventlog[Application,,,Acronis Backup and Recovery,1,,skip].logseverity()}=1 => To check if theire is an ew Information log entry in the Event log -> Backup Succes for example

so i changed it now to

{HOST-Acronis:eventlog[Application,,,Acronis Backup and Recovery,1,,skip].nodata(10)}=0

Ill try and do this

[BartTechne]

Problem has indeed been created but not autoclosed

{Acronis:eventlog[Application,,,Acronis Backup and Recovery,1,,skip].nodata(10)}=0

[nneka]

The problem will autoclosed if you not receive data (no entry in the event log) during 10 minutes ,
checl if you contniue to receive data after the creation of incident

[BartTechne]

{Acronis:eventlog[Application,Event 0x900001: Error code: 12,,Acronis Backup and Recovery,1,,skip].nodata(10)}=0

last entry at 23.30.59 then the trigger went off. But after that no closure

[BartTechne]

@nneka:
tried this with 100 as trigger. It is specified in seconds according to the documentation. But still... no closure. Theire is no date coming in for the last 10 hours

[josoko]

BartTechne

I was faced also to this problem, of how to autoclose events in Zabbix. I solved my problem with a Webhook similar related to this Zabbix blog:
- https://blog.zabbix.com/close-proble...bix-api/12461/

It's the best way to that. Just doing some actions, and if it's done, the event will be closed.

[Zablab]

Seems like a simple thing but I'm also having this issue. We have an information trigger configured to notify us of site Version changes. We'd like to auto close these after 7 days and I am not having luck with it.

Trigger expression:

last(/site/site.version_number,#1) <> last(/site/site.version_number,#2)

Example of a recovery expression I've tried that doesn't work, but the idea would be to close it after 7 days if the version doesn't change:

nodata(/site/site/site.version_number,604800)=1

[Zablab]

So this cleared out all the problems older than 7 days, I do have pre-processing set to discard unchanged with heartbeat and should only get a value if the site updates in my scenario.

nodata(/site/site.version_number,7d)=0

[cyber]

Basics...
Recovery expression is ADDITIONAL condition, that has to be true for trigger to become false AFTER trigger condition is already turned false.

So if you compare last 2 values and also have recovery condition of "no data for one week", then you really should not have any data coming in during that week. But I assume you check it more often, like once a day... So recovery never becomes true and you whole trigger stays in problem state...