as I restrict triger with expression {#IFNAME} = ppp0 ?

[flako]

hello
Upgrade to Zabbix 1.8.4 to 2.4 and I'm testing Low-level discovery.
I need to restrict a trigger for a value of {#IFNAME} = ppp0, I need to be triggered if the incoming traffic on the ppp0 interface exceeds 50kb, so the first probe with:
{Tempt_Equipo_Linux_ligero:net.if.in[{#IFNAME},bytes].min(10m)}>51200

and shooting correctly, when I want to restrict {#IFNAME}=ppp0 indicates syntax error.

with:
{Tempt_Equipo_Linux_ligero:net.if.in[{#IFNAME},bytes].min(10m)}>51200 and {#IFNAME} = ppp0
Indicates error:

Incorrect trigger expression. Check expression part starting from " ppp0". 
[trigger_prototypes.php:165 → CFrontendApiWrapper->update() → 
CApiWrapper->__call() → CFrontendApiWrapper->callMethod() → 
CApiWrapper->callMethod() → CFrontendApiWrapper->callClientMethod() → 
CLocalApiClient->callMethod() → call_user_func_array() → 
CTriggerPrototype->update() → CTriggerPrototype->validateUpdate() → 
CTriggerPrototype->validateTriggerPrototypeExpression() → CApiService::exception() 
in /srv/www/htdocs/zabbix/include/classes/api/services/CTriggerPrototype.php:1004]

Viewing post, I understand that it can be done, but something I'm doing wrong, because my does not work me.
I guess it is a syntactic error, but I do not see where is the error.

Thanks for reading this far (as below), and excuse my English

[evertonco]

According to the documentation (Trigger expression), all trigger follow the syntax below:

{<server>:<key>.<function>(<parameter>)}<operator><constant>

{#IFNAME} = ppp0 is not allowed.

Just create an item "ppp0" and a trigger using it, instead of using low-level discovery for this interface.

[flako]

Just create an item "ppp0" and a trigger using it, instead of using low-level discovery for this interface.

Your simple response is good, but not bad I thought ...
I thought of the macros. regex that does not include them and may put macros in trigger expressions.
If you can not put {#IFNAME] (assumed 'macros') is a shame,because it loses much power the Low-level discovery.

knowing 'Low-level discovery.' makes me furious having to make a special case (creating an item) to ppp0.

[evertonco]

What you need to keep in your mind is low-level discovery (LLD) is a mechanism to automatically create items, triggers and graphs for ALL entities of a host. This is the true power of LLD.

If you could create a trigger expression containing "{#IFNAME} = ppp0", this trigger would be created for each interface discovered. This makes no sense.

From the documentation (Low level discovery):

These macros are then used in names, keys, and other prototype fields that are basis for creating real items, triggers, and graphs for each discovered entity. These macros can be used:

  - for item prototypes in
    - names
    - keys
    - SNMP OIDs
    - calculated item formulas
    - SSH and Telnet scripts
    - database monitor item parameters
  - [B]for trigger prototypes in
    - names
    - expressions (insofar as when referencing an item key prototype and as standalone constants)[/B]
  - for graph prototypes in
    - names

You can exclude some entities (like ppp0) of your discovery by using "Filter" option on LLD configuration screen.

In your case, I think better solution is create a LLD excluding ppp0 interface and create items and triggers for this interface individually, as I said.

[flako]

evertonco:
What set as you indicated and it works correctly. Thank you.

[vchrizz]

based on this post Edit vfs.fs.size trigger NOT to go off for disk C: i created following workaround which might help in this case:

using "Template OS Linux" ("Discovery rules" -> "Network interface discovery")

"Item prototypes" -> Create item prototype

Name: Interface echo name {#IFNAME}
Type: External check
Key:  echo["{#FSNAME}"]
Type of information: Text

"Trigger prototypes" -> Create trigger prototype

Name: Over 10 MBit/s Incoming Traffic in last 5min on Interface {#IFNAME}
Expression: {Template OS Linux:net.if.in[{#IFNAME}].last(5m)}>10M and {Template OS Linux:echo["{#IFNAME}"].regexp(^ppp)}=1

"Trigger prototypes" -> Create trigger prototype

Name: Over 10 MBit/s Outgoing Traffic in last 5min on Interface {#IFNAME}
Expression: {Template OS Linux:net.if.out[{#IFNAME}].last(5m)}>10M and {Template OS Linux:echo["{#IFNAME}"].regexp(^ppp)}=1

have in mind that this creates triggers for *every* discovered interface, if you monitor devices with many interfaces, you might want to exclude unneeded interfaces from discovery in Administration->General->Regular expressions->Network interfaces for discovery

tested on zabbix 3.2.7.

[vchrizz]

if you dont like the approach having many items and triggers, see thread Create trigger for interfaces where i posted another (rather more simple) approach.