Zabbix eth0 incoming traffic, triggering false alarms?

[GoatZero]

I'm a bit confused right now, I just got this false alarm



I did a full clean Zabbix 4.2.1 setup, (deleted every single preexisting configuration to start from 0)

I had an item set up to monitor incoming and outgoing traffic on my servers and despite it working as intended for A WHOLE MONTH, suddenly I get a peak, smaller than several others, that triggers an alert, here's the graph highlighting what triggered the alert (18 Sept, at 9am), notice that after the event it didn't trigger the rest of the day or on days 19 to 24 (september)



When this alert was triggered, my trigger function was set up as

{Basic Monitoring:net.if.in[eth0,bytes].avg(60)}>20M

However, I'm a bit worried this might happen again, meaning I did not understand o setup the item/trigger wrong, so I post this here in the hope something can explain why did this happen?

Here are both my item, and function used for this alert





I could really use some feedback about why or how did this happen, im just confused

Right now I increased the values to:

{Basic Monitoring:net.if.in[eth0,bytes].avg(120)}>25M

Hoping it averages 24 values in a time period of 2 minutes and if its above 25Mbps TRIGGER the alert, but im not sure about the inner workings of the AVG function anymore

[1berto]

1) There is no way to know (only seeing the images) that it's (or was) a false alarm.
2) Your last image is showing the 'old' trigger, that was your intent?
3) I don't have this type of trigger in my solution, but 5s seems a very high frequency to a 60s trigger. I would start with a smaller frequency, made some tests (sending traffic to the host) and adjust the item/trigger accordingly.
4) I don't know this function, but are you sure that you have the traffic for a period, it's not the sum of all traffic since the interface had started?

[GoatZero]

1.- Well, the point is that the alarm was triggered and solved almost at the moment but only happened in THAT peak, (how come it doesn't happen with even bigger ones ), I can prove its that peak by the date posted on the alarm action,
2.- yes that was the intent, I might edit the post a bit to clear this out
3.- This is actually a good idea, however, the function should be averaging values for 1 minute, and thats my main concern right ow
4.- As far as I understand the avg function supposed to just average 60 seconds of values (5s x 12 values) and if the value is higher than 20Mbps, THEN trigger the function, however, I'm a bit worried about how it is actually doing the calculation, and yes I'm sure, its not the sum of all traffic (I know because at the start i was using the default eth0 incoming that actually does the sum of the incoming traffic, fixed this by adding a preprocessing step to do a Change per second )

[1berto]

1) This peak isn't enough to change the average above the limit?
4) The fact that you are taking the value from 5s to 5s don't imply that its calculated on the agent in the same frequency (i think), what do you get when you try this item for this host using zabbix_get two times?

If everything is OK (lets say, the reading is from 5 to 5 seconds) wouldn't be better to use min instead of average?

{Basic Monitoring:net.if.in[eth0,bytes].min(60)}>20M This text can give you some tips:
https://blog.zabbix.com/no-more-flap...mart-way/1488/

[GoatZero]

That Link is actually really useful, I think I will stick with the MIN function instead of the AVG, might take a while to test them out but it makes perfect sense