Last trigger function not working

[registration_is_lame]

I have a item which is polled every 12 seconds. It produces only value 0 and 4. 0 means status is down, 4 means status is up.

Trigger:

{host1:item_status.max(#3)}<>4

Recovery:

{host1:item_status.last(10m)}=4

But the recovery alerts recovers instantly as soon as it sees value "4". I wanted it to ensure that for 10 minutes the value should be "4". Any idea what is wrong?


Latest data history values:

2019-12-31 08:47:41 4 -> Alerts gets recovery instantly
2019-12-31 08:46:41 0 -> Alerts gets triggered
2019-12-31 08:45:41 0
2019-12-31 08:44:41 0
2019-12-31 08:44:17 4

[gofree]

youre usin the time parameter wrong in the last funtcion - see more in documentation - its being used as time shift

https://www.zabbix.com/documentation...gers/functions

gues you have to use mn, max functions for better result

[registration_is_lame]

Can you give me an example of how last function should be used? BTW I even tried

{host1:item_status.max(#50)}=4

but still it recovered instantly.

[gofree]

you wil not be able to do it with last function as it can only use time shift function ( read the docu for what it does - basically it moves the evaluation point in the past )

what you need is t to work with min function and set the time ( or number of counts to ) to desired value

again try to read the docu

min (sec|#num,<time_shift>)
Lowest value of an item within the defined evaluation period.	sec or #num - maximum evaluation period1 in seconds or in latest collected values (preceded by a hash mark) time_shift (optional) - see avg()	Supported value types: float, int The time_shift parameter is supported since Zabbix 1.8.2.

maybe something like
{host1:item_status.min(600)}=4

[registration_is_lame]

That worked. But I do have some questions. It looks like some things have changed and so my understanding about it as well.

min (sec|#num,<time_shift>)
Lowest value of an item within the defined evaluation period.	sec or #num - maximum evaluation period1 in seconds or in latest collected values (preceded by a hash mark) time_shift (optional) - see avg()	Supported value types: float, int The time_shift parameter is supported since Zabbix 1.8.2

{host1:item_status.min(600)}=4


All these days I thought min and max function something like this: Someone on the forums wrote this and I understood it that way. This seems correct because I verified with a item when using "min" function and the recovery alert was sent out when there was just one value.

min(5m)=4 -> if at least one value is "4" within the 5 minute period (which means 5 values if polled every 60 seconds).
max(5m)=4 -> All values should be "4" within the 5 minutes period.


Also I wonder if they changed the documentation for last function? I think the following was working before.

last(5m)=4 -> All values within 5 minutes period should be 4. -> I'm kinda sure this was working before, I mean I had a ICMP trigger which had a recovery like "last(15m)=1" and after the alert started, it doesn't recover for 15 minutes to ensure stability. That's why I tried the last function on item_stats item.

I'm not sure I ever noticed "sec (ignored) before. Does it mean "seconds" isn't valid anymore?

last (sec|#num,<time_shift>)
The most recent value.	sec (ignored) or #num - the Nth most recent value time_shift (optional) - see avg()	Supported value types: float, int, str, text, log

[1berto]

I don't know if i undersant your question, and even can't try it now, but i think that max(5m)=4 implies that the 'upper' value in the last 5 min should be 4... So the trigger won't be fired if the values are: 4,4,5,4,4 (5 is the max value).
In most scenarios i thinkg that the triggers should be relative too, like last(5m)>3 or last(5m)<5 depending on the nature of your data.