Triggering actions on icmp loss, and then icmp recovery.

[fxm73]

I have a set of triggers that I'm having problems with, which I'm hoping someone can assist with. I have a set of devices which I am monitoring and now wish to alerts certain people based upon information pulled from the host. (We populate the primary contract email, & cell from SNMP information we pull from devices int he field.)

Our hosts are polled every 60 seconds via ICMP.

So I have two triggers configured.

#1 - When the site is down - I.E. no ICMP response for 20 minutes then we trigger an alarm which in turns has an action to email the person associated with the device. (This is working.)

Configuration > Templates > Broadband Alert > Trigger > Email Alert - Site down

The Trigger

{Broadband Alert:icmppingloss.min(20m)}>19

This trigger works, so when the site does not have a valid ICMP reply in 20 minutes an action then run which runs a script (See: https://www.zabbix.com/forum/showthread.php?t=47425)

#2 - When the site is up and has been for 20 minutes then we trigger an alarm which in turns has an action to email the person associated with the device. (This is partially working.)

This works however as soon as the device comes online the alert is sent. I can't seem to wrap my mind around how I should be configuring this trigger.

I've attempted to use icmpping.max/min/count/last which all work but send the alert as soon as the site is up and not when the site has been up for 20 minutes.

Configuration > Templates > Broadband Alert > Trigger > Email Alert - Site up

Some of the Expressions I've tried has been

{Broadband Alert:icmpping.last(20,20)}>19
{Broadband Alert:icmpping.max(5m)}>5

I'm wondering where I've gone off path, and how I can resolve the issue.