Correct trigger expression for str.

[dmalchikov]

Hi there,
Try to get optimal alert settings (trigger expression)
Anyone has such task?

I have Item returning string with status: check_node[C:\Admin\Monitoring.xml] every 60s

Result data like:
2019-04-22 13:10:43 "Normal" Count="0"
2019-04-22 12:57:43 "Error" Count="1"><Error Category="Node"DFS failed

Current trigger
Monitoring:{check_node[C:\Admin\Monitoring.xml].str(Error,#1)}=1 and {Monitoring:check_node[C:\Admin\Monitoring.xml].diff()}=0

It's generate alert after first record with "Error" but
I need alert only sends after 2nd of 3rd record contains "Error"

[brunohl]

You could use something like

{Monitoring:check_node[C:\Admin\Monitoring.xml].last(#1).str(Error)} = 1 and {Monitoring:check_node[C:\Admin\Monitoring.xml].last(#2).str(Error)} = 1 and {Monitoring:check_node[C:\Admin\Monitoring.xml].last(#3).str(Error)} = 1

[dmalchikov]

Thanks for idea! But I still get alert at first error

[brunohl]

Ah, I guess that since you're returning full log on every check it may be triggering because the last 3 checks contain error, but it's just one.
You could try with count (https://www.zabbix.com/documentation...gers/functions) [⇒ count(10m,"error",eq) → number of values for last 10 minutes that equal 'error']

Maybe something like:

{Monitoring:check_node[C:\Admin\Monitoring.xml]count(10m,"Error",eq)} > 3