When a new line appears in a log file, trigger, send _ONE_ alert, then timeout.

[Symon]

Hello, I've got a snort logging to a logfile on a machine which has a Zabbix agent running. I want my Zabbix master server to trigger when a new line appears in the logfile. This trigger should send me an alert. Then I want the trigger to revert to OK, after a timeout, say 15 minutes. I have this working, except that it sends a multiple alerts, in my case via XMPP. One every 30 seconds during the timeout period. How can I get it to only send me one alert per new line?
Trigger is :-
{myserver:log[/var/log/snort/alert,,,,skip,].nodata(15m)}=0
I've tried adding AND triggers, e.g. as above with nodata replaced by regexp , diff but no luck. I've used active checks also in the item. I tried searching for this issue, the nearest I could find was this:-

https://www.zabbix.com/forum/zabbix-help/41218-howto-zabbix-2-4-postgres-sql-to-reset-trigger-s-state?t=49072

but that seems a bit complicated.
Thanks for reading.

[boyemillar]

Hi Symon,

I use a Recovery Expression to close the problem if it has not re-occurred in the last 5 minutes

[Symon]

Hi Boye, thank you very much for your reply. So, as I was running version 3.0, my trigger menu didn't have the 'Recovery expression' option. That encouraged me to upgrade. If I'm gonna upgrade, might as well go to the latest, right? 4.0 here I come. Anyway, after a brief battle with selinux*, I'm back in the game with 4.0. This provides me with your solution, but also a better one as well. Triggers in 4.0 support "Allow manual close" which, I now realise, is what I wanted all along. I want to make sure I see snort alerts, and this means they stay displayed until I manually OK them. The upshot is, although I didn't use your solution per se, it did lead me to what I actually wanted. Thanks again, and all the best!
* https://stopdisablingselinux.com/ :-)