Item and Trigger interval relationship

[stark001]

Hello all,

I have created a simple check item to test ICMP against a host. Interval set to 30s. It is working properly.
But things got strange when I try to use a trigger function count() and max(). Item interval has being taking precedence and time interval set in the trigger expression itself has been ignored.

For example: If I set " .max(120)=0 " function in my Trigger, it does not wait 120 seconds to start the first trigger message, instead, it starts it within 30 seconds (the item interval itself).

So, What Am I doing wrong here?

Thanks in advance.

[Hamardaban]

Function values are calculated when the data item receives a value.The first obtained value is also included in the selected period of 120s and participates in the calculation of the max function . if there are no other values - then one will be the maximum.

[stark001]

Hello Hamardaban, thanks for your reply, but I did not get your point. The idea is: my trigger should only fire after the consolidation interval in the max function. That's what is set in the expression.
The returned value is correct, but, it has always being triggered after item interval itself, it is not waiting for my max() interval. So, I want my trigger to fire after 120 seconds and return the value after my max() function evalution and trigger after 30 seconds (item interval itself), what is happining in this case. How can I accomplish that? Regards !

[stark001]

Hello Hamardaban, thanks for your reply, but I did not get your point. The idea is: my trigger should only fire after the consolidation interval in the max function. That's what is set in the expression.
The returned value is correct, but, it has always being triggered after item interval itself, it is not waiting for my max() interval. So, I want my trigger to fire after 120 seconds and return the value after my max() function evalution and trigger after 30 seconds (item interval itself), what is happining in this case. How can I accomplish that? Regards !

[demoss]

You're misunderstanding how max() works. As Hamardaban said, max() takes the highest value from the last 120 seconds - regardless of whether values actually exist for ALL of that time and regardless of whether your trigger existed for all of that time. It's reevaluated whenever the item data is received. You'll only see the difference when your trigger has just been created, though, so I can't imagine that it's worth worrying about.

[stark001]

Humm...so, guess I am misunderstanding the concept of item and trigger themselves...I got the explanation about max() function, you guys made that very clear by the way.
But I did not understand yet the question about trigger firing interval.
My wish is to fire the trigger action only after its interval of 120 seconds (defined in max function). But the trigger is firing every 30 secs (item interval itself).
Does the function max() or any other similar functions only consolidates the data, but what make the trigger "firing" (with its action) is the item interval itself and not any other consolidation interval used inside triggers' functions? That's is it??!!
Regards !

[Hamardaban]

Use something like sum(#4)=0 (the amount of the last four received values equal 0) . As you need - 4*10sec=120sec

[stark001]

Hey guys...I am really missing something here. I did your suggestion, but my trigger is still firing every 30 secs. Look at these:

My trigger:



My item:


Firing intervals:



Same happens even changing with sum() function as you suggested:



As you guys can see, the trigger is firing every 30 seconds. My expectation is that it fires at every 120 seconds (interval set by max function in the trigger itself).
Is that the expected behavior, or am I missing some key concept over here??

Regards !

[demoss]

The key point is that the trigger expression is evaluated every time the item collects data, at which point Zabbix looks back as needed at the data it has already collected. So if you REALLY only want it to be checked every 120 seconds, only collect the data every 120 seconds - but even as you're set up, you still shouldn't trigger until you've received a "0" result four times, so that's not the change I'd make. That said, I don't see why it keeps triggering from what you've posted - by default, when a trigger goes into problem state, it stops triggering unless you've configured it to do otherwise. You probably have the "PROBLEM event generation mode" in your trigger set to Multiple, and Single is more likely what you want here.

Generally speaking, when you're trying to figure out why a trigger is doing what it is doing, going to Latest Data and looking at what's actually coming in can be helpful as well. If you can bring your target system up and down at will, leave it up, clear the problems, and then bring it down, all while watching the graph of results and noting when the problem triggers. That's the best way to see whether your trigger expression is doing what you think it is doing. It's also possible to test the expression in the expression constructor, but that only tests the logic of the expression and can't eliminate the possibility that the data you're collecting isn't what you think it is.

[stark001]

Hello demoss , yeah, I was really using generation mode set to "Multiple". Anyway, I have changed it to "Single". Restarted everything, simulate a UP/DOWN action, but, even that, same behavior is happening. It does not wait to count 4 item intervals to trigger, it trigger at first 30 secs interval. I really do not know what's happening here. If it is a concept misunderstanding or some configuration done wrong. My point is, my 30 secs item should only trigger after #4 count in sum() function or 120secs in max() function. But for both situations it triggers at item interval itself, after 30secs.
Hard mission here...but thank you anyway...hope we could come up with a solution. Still with problem :/
Best Regards.